Loading vulnerability…
CVE-2026-26111 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool caused by an integer overflow or wraparound condition. The flaw affects RRAS handling during interactions with remote servers through the RRAS snap-in or management interface. Available reporting indicates that exploitation can occur when a user or administrator connects, or is induced to send a request, to an attacker-controlled or malicious server, which then returns crafted data that triggers the vulnerable condition. Under those circumstances, the overflow can lead to memory corruption and execution of attacker-controlled code on the affected Windows system.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit/simulation lab with 2 files: a README and one Python script. The README describes an educational lab for simulating Windows 11 RRAS-related vulnerabilities (CVE-2026-25172, CVE-2026-25173, CVE-2026-26111) in an isolated virtual network, including example attacker/victim IPs and patch/build guidance. The code file, rras_exploit.py, is the main entry point and implements a simple malicious TCP server using Python's socket module. When a client connects, it sends a crafted binary payload composed of a fixed header, the maximum 32-bit unsigned integer (0xFFFFFFFF) packed little-endian, and 1024 bytes of padding. The intended capability is to simulate an integer-overflow-triggering malformed RRAS response that could cause denial of service or abnormal behavior on a vulnerable Windows 11 RRAS management component. Notably, the script prints that it is starting on port 1723, but actually binds to TCP port 445, which is an inconsistency that may indicate either a bug or incomplete adaptation of the PoC. There is no shell payload, persistence, lateral movement, or post-exploitation logic; it is a basic malicious service PoC rather than a full weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An additional vulnerability in the Windows RRAS management tool that increases the risk of remote code execution during interactions with malicious servers.
An additional Windows RRAS management tool vulnerability that may allow code execution under certain conditions and increases the overall risk posed by the related RRAS flaws.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool affecting certain Windows 11 Enterprise hotpatch-enrolled devices used for remote server management.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool that can be triggered when a domain-joined user connects to a malicious server via the RRAS Snap-in.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.