CVE-2026-26111: 
vulnerability analysis and mitigation

CVE-2026-26111 is an integer overflow/wraparound vulnerability in the Windows Routing and Remote Access Service (RRAS) that leads to a heap-based buffer overflow, enabling remote code execution by an attacker with low privileges. It was disclosed and patched on March 10, 2026, as part of Microsoft's March 2026 Patch Tuesday security update release. The vulnerability affects a broad range of Microsoft Windows products, including Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H2 through 26H1), and Windows Server 2012 through 2025. It carries a CVSS v3.1 base score of 8.0 (High) (Microsoft MSRC).

The root cause is an integer overflow or wraparound (CWE-190) in the Windows RRAS component that subsequently triggers a heap-based buffer overflow (CWE-122). An attacker with low privileges can send specially crafted network requests that cause an arithmetic overflow when calculating buffer sizes, resulting in an undersized heap allocation that is then overflowed with attacker-controlled data. Exploitation requires user interaction (UI:R) but no elevated privileges beyond a low-privileged network account, and the attack vector is network-based with low complexity. The vulnerability is mapped to CAPEC-92 (Forced Integer Overflow) (Microsoft MSRC).

Successful exploitation allows an unauthorized, low-privileged attacker to execute arbitrary code remotely on the affected Windows system, resulting in complete compromise across all three security dimensions: high confidentiality impact (unauthorized access to sensitive data), high integrity impact (modification or deletion of data), and high availability impact (disruption of system services). The vulnerability affects a wide range of Windows desktop and server platforms, increasing the potential attack surface across enterprise environments. Given RRAS is commonly deployed on Windows Server systems acting as VPN or routing gateways, exploitation could serve as an entry point for lateral movement into internal networks (Microsoft MSRC).

Microsoft released patches on March 10, 2026 (Patch Tuesday) addressing this vulnerability across all affected platforms. Specific patched versions include: Windows Server 2012 (6.2.9200.25973), Windows Server 2012 R2 (6.3.9600.23074), Windows Server 2016 (10.0.14393.8957), Windows Server 2019 (10.0.17763.8511), Windows Server 2022 (10.0.20348.4893), Windows Server 2022 23H2 (10.0.25398.2207), and Windows Server 2025 (10.0.26100.32522). An additional out-of-band hotpatch (KB5084597) was released on March 14–15, 2026, specifically for Windows 11 24H2 and 25H2 managed devices (BleepingComputer, Microsoft MSRC). Organizations should prioritize patching internet-facing Windows Server systems running RRAS first, and consider restricting RRAS access to authorized users only until patches are applied.

The vulnerability received notable attention due to Microsoft issuing an out-of-band hotpatch (KB5084597) for Windows 11 shortly after Patch Tuesday, which is relatively uncommon and signals elevated urgency. BleepingComputer, Neowin, and multiple security outlets covered the OOB release, with community discussion on Reddit's r/pwnhub highlighting the critical nature of the RRAS RCE flaws (BleepingComputer, Neowin). Rapid7 and Sophos both included this CVE in their March 2026 Patch Tuesday review blogs, noting the broad scope of affected Windows versions (Rapid7 Blog, Sophos Blog). The Zero Day Initiative also covered it in their March 2026 security update review (ZDI Blog).