A critical remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) exposes multiple versions of Windows to total system compromise by unauthenticated attackers.

This is a heap-based buffer overflow (CWE-122) within the Routing and Remote Access Service (RRAS). The vulnerability is reachable via the network without user interaction or authentication (AV:N/AC:L/PR:N/UI:N).

The ability for an unauthenticated remote attacker to execute arbitrary code on a server or workstation poses a catastrophic risk to organizational security. With a CVSS score of 9.8, this flaw facilitates full system compromise, including data exfiltration, lateral movement, and the potential for complete service disruption.

Immediate Action: Apply the vendor-provided security updates immediately to the affected Windows builds as listed in the enrichment data. Ensure all systems are patched to at least the specified fixed versions to negate the overflow condition.

Proactive Monitoring: Monitor network traffic for unusual activity directed at RRAS-related ports and review system event logs for service crashes or unexpected process executions.

Compensating Controls: If immediate patching is not possible, disable the Routing and Remote Access Service on machines where it is not strictly required to reduce the attack surface.

Public Exploit Available: Unknown.

This vulnerability represents a severe threat to infrastructure integrity due to its wormable potential and lack of required authentication. IT teams should prioritize the deployment of the September 2026 security updates across all identified Windows platforms to eliminate this critical risk.