BLUF

Organizations operating Windows Routing and Remote Access Service infrastructure that is reachable from external networks face elevated enterprise risk because exploitation of these vulnerabilities could allow attackers to execute code on trusted remote-access gateway systems that provide connectivity between external users and internal networks. The vulnerabilities originate from memory-handling weaknesses within RRAS network request processing that may allow specially crafted network traffic to trigger unsafe service behavior. Public vulnerability records describe the issues as remotely exploitable within RRAS components, although currently available reporting has not confirmed active exploitation campaigns associated with these vulnerabilities at the time of this assessment. Security leadership should ensure affected systems are patched immediately and increase monitoring of gateway systems until remediation is verified.

Executive Risk Translation

Compromise of an RRAS gateway could allow attackers to obtain a trusted internal foothold that may enable credential theft, lateral movement, and further compromise of enterprise systems.

Why This Matters Now

Remote-access infrastructure is essential for modern enterprise operations because it enables employees, administrators, and partners to securely connect to internal systems from external networks. Systems providing this functionality often maintain trusted connectivity to authentication infrastructure and internal enterprise services. Vulnerabilities affecting these systems introduce concentrated risk because compromise of a single gateway can create access pathways into multiple internal environments. Prompt remediation significantly reduces the likelihood that attackers could leverage such systems as entry points.

Key Judgments

• RRAS gateway systems represent high-value initial access targets because they function as trusted remote-access infrastructure brokering authenticated connectivity between external networks and internal enterprise resources.
• Vulnerabilities affecting externally reachable services frequently attract exploit development once technical details become publicly analyzed.
• Even a small number of vulnerable gateway systems can create disproportionate organizational risk because they bridge external connectivity and internal networks.
• Monitoring for abnormal service execution and unusual outbound network activity on gateway systems provides early indicators of potential compromise.

Executive Risk Summary

Organizations exposing RRAS services to external networks face elevated operational risk if the relevant security updates have not yet been applied. Gateway systems commonly maintain connectivity to authentication infrastructure, administrative networks, and internal applications, meaning compromise could provide attackers with a direct foothold inside enterprise environments. Because these systems operate as trusted access points, exploitation could allow attackers to bypass traditional perimeter security controls. Ensuring that RRAS gateway systems is patched and actively monitored significantly reduces the likelihood that attackers could leverage these vulnerabilities for internal network access.

Estimated Probability of Recurrence (12-Month Horizon)

Estimated probability of exploitation attempt
Moderate probability band (25–50 percent)

Drivers influencing probability

• Exposure of remote-access gateway services to external networks
• High attacker value associated with gateway compromise for initial access
• Potential exploit development following vulnerability disclosure

Factors reducing probability

• Limited prevalence of RRAS compared with many other Windows services
• Rapid remediation by organizations with mature vulnerability management programs

Executive Cost Summary

Estimated financial exposure associated with compromise of remote-access gateway infrastructure varies depending on attacker objectives and the scope of internal network access obtained.

For organizations affected by RRAS vulnerabilities

Low impact scenario

• Estimated range: $50,000 – $250,000
• Limited disruption affecting remote-access operations
• Investigation validating patch status and system integrity

Moderate impact scenario

• Estimated range: $250,000 – $1,500,000
• Security incident response investigation and containment
• Gateway infrastructure rebuild and credential reset activities
• Internal network validation to confirm absence of lateral movement

High impact scenario

• Estimated range: $1,500,000 – $7,000,000
• Enterprise-wide incident response if attackers move beyond gateway systems
• Extended disruption of remote-access services
• Infrastructure restoration and incident recovery costs

Key Cost Drivers

• Time required to detect gateway compromise
• Level of internal network access obtained by attackers
• Scope of infrastructure requiring investigation and remediation

Estimated Annualized Risk Exposure

• Moderate exposure band reflecting the combination of the estimated 25–50 percent exploitation attempt probability and the potential operational impact associated with gateway compromise.

Control Effectiveness Context

• Rapid deployment and validation of vendor security updates significantly reduces the likelihood that these vulnerabilities could be leveraged for gateway compromise.

Risk Register Entry

• Potential compromise of externally reachable RRAS gateway infrastructure resulting from unpatched remote code execution vulnerabilities.

Compliance Exposure Indicator

• Review of security controls protecting externally exposed infrastructure
• Internal audit review of vulnerability management and patch deployment practices
• Potential regulatory reporting requirements depending on incident scope

Risk Drivers

• External exposure of RRAS gateway services providing remote connectivity into enterprise networks
• Trusted network position of gateway systems bridging external and internal infrastructure
• Potential exploit development following vulnerability disclosure of remotely reachable services
• Operational value of gateway compromise for credential harvesting and follow-on attack activity

Bottom Line for Executives

The RRAS vulnerabilities represent a focused but potentially high-impact exposure affecting externally reachable gateway systems rather than large numbers of endpoint devices. Although the number of affected systems in most environments is limited, those systems often occupy highly trusted positions within enterprise network architecture. Rapid patch deployment and enhanced monitoring of gateway activity significantly reduce the likelihood that attackers could exploit these vulnerabilities to gain internal network access.

Board-Level Takeaway

A small number of externally exposed gateway systems can represent disproportionate enterprise risk, and ensuring that those systems are patched and monitored should be treated as a priority security action.

Affected Sectors and Countries

Affected sectors

• Government and public sector organizations
• Financial services institutions
• Healthcare providers
• Critical infrastructure operators
• Enterprise environments operating remote-access gateway infrastructure

Countries affected

• Global exposure

o   Due to widespread Windows deployment and enterprise remote-access infrastructure

Targeting Probability Assessment

High targeting probability

• Government networks
• Financial services organizations
• Critical infrastructure operators

Moderate targeting probability

• Large enterprises operating VPN gateway infrastructure
• Managed service providers

Lower targeting probability

• Organizations with minimal externally exposed infrastructure

Threat Overview

The March 2026 Windows security update cycle addressed multiple vulnerabilities affecting the Windows Routing and Remote Access Service (RRAS). RRAS provides VPN connectivity, routing services, and remote access capabilities that allow organizations to provide secure remote access to internal network resources.

The vulnerabilities tracked as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111 involve memory-handling weaknesses in RRAS network request processing that may allow specially crafted network traffic to trigger unsafe service conditions that could lead to remote code execution.

Because RRAS systems often operate as remote-access gateway infrastructure connecting external users to internal enterprise networks, successful exploitation could allow attackers to obtain a trusted foothold within internal network segments.

Exploit Status

Exploit status assessment

• Public vulnerability records describe the vulnerabilities as remotely exploitable within RRAS components
• No confirmed in-the-wild exploitation campaigns have been publicly reported at the time of this assessment

o   CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111 are not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog

KEV inclusion criteria

• CISA adds vulnerabilities to the KEV catalog when there is verified evidence of exploitation in real-world environments
• At the time of analysis, such evidence has not been confirmed for these RRAS vulnerabilities

Operational implication

• The vulnerabilities should be classified as potentially exploitable but not confirmed exploited

Exploit Conditions Snapshot

Exploit prerequisites

• Target system running a vulnerable Windows version
   o RRAS service enabled on the host
• Network connectivity between attacker and RRAS service
   o Direct network reachability to the gateway system
   o Exposure through VPN or remote-access infrastructure
• Ability to deliver specially crafted network traffic
   o Malformed network packets interacting with vulnerable RRAS processing routines

Exposure factors increasing exploit feasibility

• Internet-exposed RRAS gateway infrastructure
   o VPN servers providing remote user connectivity
• Direct exposure of RRAS services to untrusted networks
   o Public-facing gateway deployments
• Delayed patch deployment on gateway infrastructure
   o Unpatched remote-access systems accessible from external networks

Exposure factors reducing exploit feasibility

• RRAS service disabled on affected hosts
• Network segmentation protecting gateway systems
   o Internal-only routing deployments

Rapid deployment of vendor security updates

Exploit feasibility assessment

• Exploit feasibility rating: Moderate
• Rationale

o   Vulnerability class includes integer overflow conditions that historically enable memory corruption exploits

o   RRAS services may be reachable over network connections when deployed as externally accessible gateways

o   Gateway systems frequently operate with elevated privileges

o   Reliable exploit development likely requires patch diff analysis and reverse engineering of packet-processing logic

Infrastructure exposure considerations

• RRAS commonly operates as enterprise gateway infrastructure
• Typical deployment scenarios include
   o VPN gateway systems supporting remote workforce connectivity
   o Remote administrative access infrastructure
   o Edge routing services connecting enterprise networks to external environments

Affected Technologies

Affected component

• Microsoft Windows Routing and Remote Access Service (RRAS)

Associated vulnerabilities

• CVE-2026-25172
• CVE-2026-25173
• CVE-2026-26111

Component functions

• VPN connectivity services
• Network routing functionality
• Remote-access gateway capabilities

Operational context

• RRAS systems frequently operate as network edge infrastructure

o   Connecting external networks to internal enterprise environments

Patch and Mitigation Status

Vendor remediation status

• Microsoft addressed these vulnerabilities during the March 2026 Windows security update cycle
• Systems participating in the Windows hotpatch servicing program may receive remediation through the March 2026 hotpatch update, which provides expedited patch delivery for affected Windows systems.

Patch deployment guidance

• Deploy the March 2026 Windows security updates addressing the RRAS vulnerabilities
• Apply applicable Windows hotpatch updates for supported systems
• Verify patch installation on all systems running the RRAS service

Operational mitigation measures

• Restrict external exposure of RRAS services where possible
• Validate that externally accessible gateway systems are necessary for business operations
• Monitor gateway systems for abnormal activity
   o Unexpected service execution behavior
   o Unusual outbound network communication

Adversary Capability Profiling

Exploitation capability assessment

• Exploiting RRAS vulnerabilities would likely require moderate technical capability

Adversaries capable of exploit development

• Nation-state operators
• Advanced cybercriminal groups
• Initial-access brokers

Exploit development pathway

• Vulnerability disclosure
• Patch diff analysis
• Identification of vulnerable code paths
• Development of network-based exploit payloads targeting exposed gateway infrastructure

Threat Actor Operational Objectives

Potential attacker objectives

• Establish persistent access inside enterprise networks
• Harvest authentication credentials

o   Credentials from gateway systems

o   Credentials from connected authentication infrastructure

Enable lateral movement within the internal network

• Access to administrative systems
• Movement toward sensitive internal resources

Stage follow-on attacks

• Ransomware deployment
• Espionage operations

Observed activity status

• Not observed in currently available reporting

o   May occur during post-exploitation depending on attacker objectives and target environment

Risk Appetite Interpretation

Risk interpretation considerations

• Gateway systems provide trusted connectivity between external users and internal infrastructure
• Exploitation could allow attackers to bypass traditional perimeter defenses

Security program implications

• Mature vulnerability management programs prioritize remediation of externally exposed infrastructure
• Accelerated patch deployment for gateway systems reduces the likelihood that vulnerabilities remain exposed long enough for exploit development

Confidence and Assessment Statement

Confidence level

• Moderate

Confidence rationale

• Vendor documentation clearly describes affected components and remediation guidance
• Gateway infrastructure exposure presents credible risk scenarios
• Lack of confirmed exploitation reporting introduces uncertainty regarding adversary activity and exploit maturity

Initial Access Vector Analysis

Initial access exposure

• The vulnerabilities affect the Windows Routing and Remote Access Service (RRAS).
• RRAS commonly operates as VPN and remote-access gateway infrastructure.
• Internet-facing gateway infrastructure significantly increases exploitation exposure.

Initial access pathway

• An attacker identifies an externally reachable RRAS gateway system.
• Crafted network traffic is delivered to RRAS packet-processing routines.
• Unsafe memory-handling behavior is triggered.
• Remote code execution occurs within the gateway service context.

Attack surface considerations

• VPN gateway services expose network interfaces to untrusted networks.
• Gateway systems typically reside at the enterprise network perimeter.
• Compromise of a gateway host may bypass traditional perimeter defenses.

Attack Path Modeling

Primary attack sequence

• Attacker discovers exposed RRAS gateway infrastructure.
• Malformed network packets target vulnerable request-processing routines.
• The vulnerability triggers unsafe memory conditions.
• Code execution occurs within the gateway system service context.

Follow-on attack progression

• Attacker establishes a foothold on the gateway system.
• Authentication credentials or tokens may be harvested.
• Lateral movement toward internal enterprise systems may occur.

Environmental factors influencing success

• Internet exposure of gateway infrastructure.
• Absence of security updates addressing the vulnerabilities.
• Limited monitoring of gateway host activity.

References

Vendor Advisory
Microsoft advisory describing security fixes addressing CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111

• hxxps://support.microsoft[.]com/en-us/topic/march-13-2026-hotpatch-kb5084597-os-builds-26200-7982-and-26100-7982-out-of-band-ef323fee-e70f-4f43-8bbc-1021c435bf5c

Vulnerability Records
MITRE CVE record for CVE-2026-25172

• hxxps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25172

MITRE CVE record for CVE-2026-25173

• hxxps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25173

MITRE CVE record for CVE-2026-26111

• hxxps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26111

Known Exploited Vulnerabilities (KEV)
CISA Known Exploited Vulnerabilities Catalog

• hxxps://www.cisa.gov/known-exploited-vulnerabilities-catalog

Analytical Framework
MITRE ATT&CK Framework

• hxxps://attack.mitre.org