Loading vulnerability…
CVE-2026-25173 is an integer overflow or wraparound vulnerability in the Windows Routing and Remote Access Service (RRAS) management component. The flaw affects the RRAS snap-in or management tool used for remote server administration. Exploitation occurs when a domain-joined user or administrator connects to an attacker-controlled server through the RRAS interface, allowing maliciously crafted data from that server to trigger the integer handling flaw. Microsoft describes the issue as enabling code execution over a network, and related reporting indicates the same attack path can also destabilize the RRAS component under some conditions.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit/simulation lab with 2 files: a README and one Python script. The README describes an educational lab for simulating Windows 11 RRAS-related vulnerabilities (CVE-2026-25172, CVE-2026-25173, CVE-2026-26111) in an isolated virtual network, including example attacker/victim IPs and patch/build guidance. The code file, rras_exploit.py, is the main entry point and implements a simple malicious TCP server using Python's socket module. When a client connects, it sends a crafted binary payload composed of a fixed header, the maximum 32-bit unsigned integer (0xFFFFFFFF) packed little-endian, and 1024 bytes of padding. The intended capability is to simulate an integer-overflow-triggering malformed RRAS response that could cause denial of service or abnormal behavior on a vulnerable Windows 11 RRAS management component. Notably, the script prints that it is starting on port 1723, but actually binds to TCP port 445, which is an inconsistency that may indicate either a bug or incomplete adaptation of the PoC. There is no shell payload, persistence, lateral movement, or post-exploitation logic; it is a basic malicious service PoC rather than a full weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in the Windows RRAS management component that may allow remote code execution or denial of service when connecting to an attacker-controlled server.
A related Windows RRAS management tool vulnerability that can enable remote code execution or denial of service when a victim connects to an attacker-controlled server.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool affecting certain Windows 11 Enterprise hotpatch-enrolled devices used for remote server management.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool that can be triggered when a domain-joined user connects to a malicious server via the RRAS Snap-in.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.