Heap-based buffer overflow in Windows Routing and Remote Access Service

CVE-2026-20868 is a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) that can lead to remote code execution. Microsoft published it on 2026-01-13 with CVSS 8.8 and the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. NVD shows affected Windows builds spanning legacy and current releases, including Windows 10 1607 through 22H2, Windows 11 23H2 through 25H2, and Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025, with fixed build cutoffs such as 10.0.14393.8783, 10.0.17763.8276, 10.0.19044.6809, 10.0.19045.6809, 10.0.22631.6491, 10.0.26100.7623, 10.0.26200.7623, 10.0.20348.4648, 10.0.25398.2092, and 10.0.26100.32230.

The vendor score is technically defensible in a lab because unauthenticated network-triggered RCE in a privileged Windows service is always ugly. In the real world, though, two big brakes matter: RRAS is an optional role/service rather than a universal exposure, and Microsoft's own scoring says UI:R, which means this is not a clean wormable edge-service bug. Add no KEV listing, very low EPSS, and no public exploit chain visible in official references, and the practical enterprise priority lands below a generic HIGH.

Why this verdict

• Baseline starts at 8.8 HIGH because unauthenticated network RCE in a Windows service is severe on paper.
• First downward adjustment: optional role exposure. RRAS is a niche Windows role compared with SMB, RDP, or HTTP stacks, and Microsoft documents RemoteAccess as disabled by default, so the exposed population is much smaller than the CVSS baseline assumes.
• Second downward adjustment: user interaction required. UI:R means this is not a spray-and-pray worm candidate; it implies a narrower trigger path that many modern controls and workflows will never hit.
• Third downward adjustment: no exploitation pressure. There is no KEV listing, no public in-the-wild reporting in authoritative sources reviewed, and the supplied EPSS is very low.
• Residual upward pressure remains because a successful hit lands on a gateway-class host with meaningful network position and likely high privileges.

Why not higher?

If this were UI:N on an always-on, internet-facing service, it would stay HIGH or higher without much debate. But requiring user interaction and depending on a non-default Windows role are two compounding brakes that materially reduce both reach and attacker reliability.

Why not lower?

This is still remote code execution against a Windows networking service, not a cosmetic bug or a local-only issue. On the subset of organizations that do expose RRAS gateways, compromise of that host can have outsized blast radius because it sits directly in the remote-access path.

1. Inventory RRAS immediately — Identify all systems with the Windows Remote Access role or RemoteAccess service enabled, then tag which are internet-facing. For a MEDIUM verdict there is no mitigation SLA, but do this now anyway because you cannot prioritize what you cannot see.
2. Restrict untrusted reachability — Limit RRAS exposure to required source IP ranges, VPN peers, and administrative networks. Where business allows, remove direct internet exposure or place strict edge ACLs in front of RRAS; this is the highest-value compensating control until the vendor patch is applied within the remediation window.
3. Disable unused VPN protocols — Use Microsoft guidance to turn off unneeded RRAS protocols and legacy options, especially anything retained only for backward compatibility. Reducing protocol surface cuts the number of code paths an attacker can drive before you remediate.
4. Harden gateway monitoring — Increase EDR sensitivity and alerting on RRAS hosts for service crashes, suspicious child processes, and unusual outbound connections from service contexts. This helps catch exploit attempts or post-exploitation behavior while you work through patching.
5. Patch exposed RRAS first — Apply the Microsoft security update to externally reachable RRAS hosts before the rest of the affected Windows population. Under the MEDIUM bucket there is no mitigation SLA, so go straight to the remediation window, but exposed gateways should still be treated as the front of the queue.

Run this on the target Windows host you want to verify, from an elevated PowerShell session. Example: powershell.exe -ExecutionPolicy Bypass -File .\check-cve-2026-20868.ps1; local admin is recommended because the script reads OS version data and service configuration for RemoteAccess.

# check-cve-2026-20868.ps1
# Purpose: Determine likely patch state for CVE-2026-20868 on a local Windows host.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

$ErrorActionPreference = 'Stop'

function Get-OsInfo {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    [pscustomobject]@{
        ProductName   = [string]$cv.ProductName
        DisplayVersion= [string]$cv.DisplayVersion
        ReleaseId     = [string]$cv.ReleaseId
        CurrentBuild  = [int]$cv.CurrentBuildNumber
        UBR           = [int]$cv.UBR
        BuildLabEx    = [string]$cv.BuildLabEx
    }
}

function Get-ServiceState {
    try {
        $svc = Get-CimInstance Win32_Service -Filter "Name='RemoteAccess'"
        return [pscustomobject]@{
            Present    = $true
            State      = [string]$svc.State
            StartMode  = [string]$svc.StartMode
        }
    } catch {
        return [pscustomobject]@{
            Present    = $false
            State      = 'Absent'
            StartMode  = 'Absent'
        }
    }
}

function Compare-Build {
    param(
        [int]$CurrentBuild,
        [int]$CurrentUBR,
        [int]$FixedBuild,
        [int]$FixedUBR
    )
    if ($CurrentBuild -lt $FixedBuild) { return -1 }
    if ($CurrentBuild -gt $FixedBuild) { return 1 }
    if ($CurrentUBR -lt $FixedUBR) { return -1 }
    if ($CurrentUBR -gt $FixedUBR) { return 1 }
    return 0
}

function Get-Threshold {
    param([pscustomobject]$Os)

    $pn = $Os.ProductName
    $dv = $Os.DisplayVersion
    $rb = $Os.ReleaseId
    $build = $Os.CurrentBuild

    switch ($build) {
        14393 { return @{ Name='Windows 10 1607 / Server 2016'; FixedBuild=14393; FixedUBR=8783 } }
        17763 { return @{ Name='Windows 10 1809 / Server 2019'; FixedBuild=17763; FixedUBR=8276 } }
        19044 { return @{ Name='Windows 10 21H2'; FixedBuild=19044; FixedUBR=6809 } }
        19045 { return @{ Name='Windows 10 22H2'; FixedBuild=19045; FixedUBR=6809 } }
        20348 { return @{ Name='Windows Server 2022'; FixedBuild=20348; FixedUBR=4648 } }
        22631 { return @{ Name='Windows 11 23H2'; FixedBuild=22631; FixedUBR=6491 } }
        25398 { return @{ Name='Windows Server 2022 23H2'; FixedBuild=25398; FixedUBR=2092 } }
        26100 {
            if ($pn -match 'Server 2025') {
                return @{ Name='Windows Server 2025'; FixedBuild=26100; FixedUBR=32230 }
            } else {
                return @{ Name='Windows 11 24H2'; FixedBuild=26100; FixedUBR=7623 }
            }
        }
        26200 { return @{ Name='Windows 11 25H2'; FixedBuild=26200; FixedUBR=7623 } }
        default { return $null }
    }
}

try {
    $os  = Get-OsInfo
    $svc = Get-ServiceState
    $thr = Get-Threshold -Os $os

    Write-Host ('Host OS      : {0}' -f $os.ProductName)
    Write-Host ('Display Ver  : {0}' -f ($(if ($os.DisplayVersion) { $os.DisplayVersion } else { $os.ReleaseId })))
    Write-Host ('Build        : {0}.{1}' -f $os.CurrentBuild, $os.UBR)
    Write-Host ('RemoteAccess : present={0} state={1} startmode={2}' -f $svc.Present, $svc.State, $svc.StartMode)

    if (-not $thr) {
        Write-Host 'UNKNOWN - OS build not in local threshold map; check Microsoft guidance for this platform.'
        exit 2
    }

    Write-Host ('Threshold    : {0} fixed at {1}.{2}' -f $thr.Name, $thr.FixedBuild, $thr.FixedUBR)

    $cmp = Compare-Build -CurrentBuild $os.CurrentBuild -CurrentUBR $os.UBR -FixedBuild $thr.FixedBuild -FixedUBR $thr.FixedUBR

    if ($cmp -lt 0) {
        Write-Host 'VULNERABLE - build is below the published fixed threshold for CVE-2026-20868.'
        if ($svc.Present -and $svc.StartMode -eq 'Disabled') {
            Write-Host 'Note: RemoteAccess is disabled, which reduces exposure, but the host is still below the patch level.'
        }
        exit 1
    } elseif ($cmp -ge 0) {
        Write-Host 'PATCHED - build meets or exceeds the published fixed threshold for CVE-2026-20868.'
        exit 0
    } else {
        Write-Host 'UNKNOWN - unable to compare current build to threshold.'
        exit 2
    }
}
catch {
    Write-Host ('UNKNOWN - {0}' -f $_.Exception.Message)
    exit 2
}

Sources

1. CVE.org record
2. NVD entry
3. Microsoft Security Update Guide
4. CISA Known Exploited Vulnerabilities Catalog
5. Microsoft Learn - Remote access overview
6. Microsoft Learn - RRAS service disabled by default
7. Microsoft Learn - Configure VPN protocols in RRAS
8. Vicarius detection script reference