CVE-2026-85339

Summary

A memory corruption vulnerability in Windows RRAS allows remote attackers to execute arbitrary code on affected systems with high severity impact. This flaw enables unauthorized access and potential full system compromise.

Exploitability

Exploitation requires a remote attacker with network access to the RRAS service, which is typically exposed on TCP port 1723 for PPTP connections, making it moderately difficult to exploit without prior reconnaissance.

Blast radius

If exploited, this vulnerability could allow attackers to gain full control of Windows systems running RRAS, potentially leading to widespread network compromise and lateral movement throughout the affected organization.

Detection

Monitor for unusual network traffic patterns on TCP port 1723, particularly malformed PPTP packets, and check Windows Event Logs for RRAS service errors or connection failures that may indicate exploitation attempts.

Prioritized remediation

Disable the RRAS service on systems that do not require remote access functionality, or upgrade to Windows Server 2019 version 1809 or later with the latest security updates installed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.