- The Mess: Microsoft patched CVE-2026-69590, a critical RCE in Windows Routing and Remote Access Service. The bug carries CVSS 9.8 and requires no authentication or user interaction.
- The Damage: A network attacker can potentially execute arbitrary code on a vulnerable Windows host.
- The Fix: Install Microsoft’s September 2026 security updates and check every server running RRAS.
Routing and Remote Access Service is not supposed to be an exciting attack surface.
This week it became one.
CVE-2026-69590 is a heap-based buffer overflow in Windows RRAS. Microsoft rates it 9.8 Critical, with a network attack vector, low complexity, no privileges required and no user interaction.
That is the ugly CVSS combination:
AV:N / AC:L / PR:N / UI:N
The attacker does not need an account. The victim does not need to click anything.
The vulnerability affects a wide range of Microsoft platforms, including Windows Server 2016, 2019, 2022 and 2025, as well as several Windows client releases. Microsoft has released patched builds for the affected versions.
And CVE-2026-69590 is not alone.
Microsoft’s September update also fixes several other RRAS vulnerabilities, including additional critical remote-code-execution flaws such as CVE-2026-69852, CVE-2026-72950 and CVE-2026-72959.
That concentration matters.
RRAS provides VPN and remote-access functionality. Servers using it can sit directly on the network edge, making remotely reachable vulnerabilities considerably more interesting than another local privilege escalation nobody can reach without already owning the machine.
There is currently no need to invent an exploit scenario. The vulnerability’s published CVSS vector already tells administrators what matters: remote access, no credentials, no interaction.
Patch the server.
Then check whether RRAS is actually required. If a host no longer provides VPN or routing functionality, disabling the service reduces the attack surface instead of relying on the next emergency patch.
Bugstoday Opinion
A 9.8 unauthenticated RCE in a remote-access component is exactly the kind of bug that turns a routine Patch Tuesday into an incident-response problem.
The worrying part is the cluster.
One RRAS RCE could be bad luck. Several critical RRAS vulnerabilities landing together suggest an attack surface worth auditing, not just patching.
If your Windows infrastructure exposes RRAS, assume the service is interesting to attackers.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Microsoft Security Response Center
National Vulnerability Database
BleepingComputer
