CVE-2026-20868CWE-122

CVE-2026-20868

High · published January 13, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

⚡ Watch out for the RRAS sneaky surprise! A heap-based buffer overflow in Windows Routing and Remote Access Service could let unauthorized attackers execute code remotely — and we definitely don’t want that! 🔥 Think of RRAS as a busy post office: if someone slips in a misleading package without anyone checking, they can get vital info or even swap out entire deliveries. This flaw is like that package, opening the door to unauthorized actions on your network. An attacker exploiting this vulnerability could take control of your system over the network, leading to unauthorized access, data theft, or even a complete takeover! This could be absolutely devastating for your organization, as it could compromise sensitive data and disrupt operations.

Put simply

Think of RRAS as a busy post office: if someone slips in a misleading package without anyone checking, they can get vital info or even swap out entire deliveries. This flaw is like that package, opening the door to unauthorized actions on your network. This vulnerability allows unauthorized attackers to execute arbitrary code in the context of the affected RRAS service due to improper handling of memory allocation, resulting in a heap-based buffer overflow.

What to do

An attacker exploiting this vulnerability could take control of your system over the network, leading to unauthorized access, data theft, or even a complete takeover! This could be absolutely devastating for your organization, as it could compromise sensitive data and disrupt operations. To mitigate this vulnerability, apply the latest security updates to Windows that address this issue immediately. Regularly audit your network configurations and access controls to minimize potential exposure. You've got this! With a quick patch and some vigilance, your network will be safer in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01389 · 72.1th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-01-13T23:16Z
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (3)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
    cvelistv5