Loading vulnerability…
CVE-2026-25172 is an integer overflow or wraparound vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool. The flaw is exposed during RRAS management interactions with a remote server and can be triggered when a user or administrator connects to an attacker-controlled or otherwise malicious server through the RRAS interface or snap-in. Microsoft describes the issue as affecting scenarios in which an authenticated attacker on the domain can induce a domain-joined user to send a request to a malicious server via the RRAS snap-in. A specially crafted server response can trigger the integer handling flaw, leading to memory corruption and resulting in remote code execution on the client system running the RRAS management component. In some reporting, service disruption is also noted as a possible outcome.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit/simulation lab with 2 files: a README and one Python script. The README describes an educational lab for simulating Windows 11 RRAS-related vulnerabilities (CVE-2026-25172, CVE-2026-25173, CVE-2026-26111) in an isolated virtual network, including example attacker/victim IPs and patch/build guidance. The code file, rras_exploit.py, is the main entry point and implements a simple malicious TCP server using Python's socket module. When a client connects, it sends a crafted binary payload composed of a fixed header, the maximum 32-bit unsigned integer (0xFFFFFFFF) packed little-endian, and 1024 bytes of padding. The intended capability is to simulate an integer-overflow-triggering malformed RRAS response that could cause denial of service or abnormal behavior on a vulnerable Windows 11 RRAS management component. Notably, the script prints that it is starting on port 1723, but actually binds to TCP port 445, which is an inconsistency that may indicate either a bug or incomplete adaptation of the PoC. There is no shell payload, persistence, lateral movement, or post-exploitation logic; it is a basic malicious service PoC rather than a full weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool that can be triggered by connecting to a malicious server.
A vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool that can allow a malicious remote server to cause denial of service or remote code execution when a victim connects.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool affecting certain Windows 11 Enterprise hotpatch-enrolled devices used for remote server management.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool that can be triggered when a domain-joined user connects to a malicious server via the RRAS Snap-in.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.