Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.0
Windows RRAS Integer Overflow Allows Remote Code Execution
CVE-2026-26111
Summary
A flaw in Windows RRAS can allow an attacker to take control of a Windows server. This can happen when a specially crafted packet is sent over the network. To protect your server, apply the latest Windows updates as soon as possible.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| microsoft | windows_server_2012 | <= 6.2.9200.25973 | – |
| microsoft | windows_server_2012 | r2 | – |
| microsoft | windows_server_2016 | <= 10.0.14393.8957 | – |
| microsoft | windows_server_2019 | <= 10.0.17763.8511 | – |
| microsoft | windows_server_2022 | <= 10.0.20348.4893 | – |
| microsoft | windows_server_2025 | <= 10.0.26100.32522 | – |
Original title
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
Original description
Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
nvd CVSS3.1
8.8
Vulnerability type
CWE-122
Heap-based Buffer Overflow
CWE-190
Integer Overflow
Published: 10 Mar 2026 · Updated: 14 Mar 2026 · First seen: 11 Mar 2026