CVE-2026-57096

What it actually does

CVE-2026-57096 is a local privilege escalation vulnerability caused by a heap-based buffer overflow in the Windows Routing and Remote Access Service (RRAS). An attacker who already has low-privileged authorized access to an affected Windows host can trigger unsafe memory handling in the RRAS service and potentially execute code in the security context of the service, which commonly runs with elevated Windows privileges. Successful exploitation can provide full compromise of confidentiality, integrity, and availability on the local system.

Why it matters to the business

This vulnerability can allow a user or malware with an initial foothold on a Windows workstation or server to gain higher privileges, disable security controls, access sensitive data, install persistence, or move laterally. It is especially relevant for systems where RRAS is enabled or where users can obtain local execution. The issue has a high CVSS score but currently has low EPSS, no known public exploit maturity, and is not listed in CISA KEV, so it should be prioritized as a significant hardening and patching item rather than treated as confirmed mass exploitation.

How an attack unfolds

An attacker first needs valid low-privileged access or the ability to run code locally on an affected Windows system. The attacker then interacts with the Windows Routing and Remote Access Service in a way that reaches the vulnerable heap memory handling path. By supplying crafted input, the attacker causes a heap-based buffer overflow. If reliably exploited, the overflow can corrupt process memory and redirect execution flow, allowing attacker-controlled code to run with the elevated privileges of the RRAS service. After privilege escalation, the attacker may create or modify privileged accounts, dump credentials, tamper with endpoint defenses, install persistence, or use the host as a staging point for lateral movement.

How to fix it

Apply Microsoft security updates for the affected Windows versions as soon as vendor fixes are available through Windows Update, Microsoft Update Catalog, WSUS, or enterprise patch management. Because no exact fixed build numbers were provided in the input, validate against Microsoft’s official advisory and the installed OS build after patching. If RRAS is not required, disable the Routing and Remote Access Service and prevent it from starting automatically. Restrict local interactive logon and remote administration rights to trusted administrators only. Enforce least privilege for standard users, harden endpoint protection, and monitor for suspicious activity around service crashes, privilege escalation attempts, and post-exploitation behavior.

How to confirm the fix worked

Confirm whether each Windows system is one of the affected versions and whether the latest applicable Microsoft security update has been installed. Check the installed OS build and cumulative update level against Microsoft’s security update guidance. Verify that the Routing and Remote Access Service is disabled on systems that do not require it, or running only where explicitly needed. Attempt to confirm that low-privileged users cannot administer or manipulate RRAS configuration. Review endpoint telemetry for absence of recurring RRAS crashes or abnormal child processes spawned from service-hosting processes after remediation.

Typical attack path

1. Obtain low-privileged local access to an affected Windows workstation or server through stolen credentials, phishing, malware execution, or prior exploitation of another weakness.
2. Confirm the Routing and Remote Access Service is present and reachable locally on the target system.
3. Trigger the vulnerable RRAS code path using crafted local input that causes heap memory corruption.
4. Convert the heap-based buffer overflow into local code execution in the elevated RRAS service context.
5. Use elevated privileges to disable security tools, access protected data, create persistence, dump credentials, or move laterally.

How to detect it

To determine whether exploitation may already have occurred, review Windows Event Logs, endpoint detection telemetry, crash dumps, Windows Error Reporting artifacts, service control events, and authentication logs. Focus on systems where RRAS is installed or enabled. Look for crashes or unexpected restarts of the Routing and Remote Access Service, Windows Error Reporting entries involving RRAS-related service-hosting processes, abnormal memory exception events, or service recovery activity followed by suspicious privileged actions. Correlate these events with local logons by non-administrative users, unexpected privilege changes, new local administrators, new services, suspicious scheduled tasks, credential dumping attempts, or security tool tampering. Useful log sources include System, Application, Security, Microsoft-Windows-Windows Error Reporting, Microsoft-Windows-Service Control Manager, PowerShell logs, Sysmon or EDR process telemetry, and Windows Defender/endpoint protection alerts. Because no public exploit indicators were provided, detection should emphasize behavioral evidence: RRAS instability plus rapid post-crash privilege escalation or administrative activity by accounts that previously lacked such privileges.

• RemoteAccess
• Routing and Remote Access
• RemoteAccess service terminated unexpectedly
• The Routing and Remote Access service terminated unexpectedly
• The RemoteAccess service entered the stopped state
• The RemoteAccess service entered the running state
• svchost.exe -k netsvcs
• %SystemRoot%\System32\svchost.exe
• %ProgramData%\Microsoft\Windows\WER\ReportArchive
• %ProgramData%\Microsoft\Windows\WER\ReportQueue
• HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001
• Faulting application name: svchost.exe
• Faulting module name: rras
• Exception code: 0xc0000005

What your security team should do

• Inventory affected Windows 10, Windows 11, and Windows Server systems, prioritizing servers and endpoints where RRAS is enabled.
• Apply the latest Microsoft cumulative security updates once available and verify installation through centralized patch compliance reporting.
• Disable RRAS on systems where routing, VPN, or remote access functionality is not required.
• Prioritize investigation of RRAS crashes or abnormal service behavior on systems that also show signs of suspicious local user activity.
• Restrict local logon, RDP, WinRM, and administrative access to reduce the chance that a low-privileged attacker can reach the vulnerable local attack surface.
• Monitor for post-exploitation behaviors such as new local administrators, credential dumping, endpoint protection tampering, suspicious scheduled tasks, and unauthorized services.
• Because the vulnerability is not currently in KEV and has low EPSS, treat it as high-impact patching work but continue monitoring for any change in exploit availability or threat actor adoption.