Loading vulnerability…
CVE-2026-26111 is an integer overflow or wraparound vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool. The flaw can be triggered during RRAS snap-in interactions with a malicious remote server, where crafted network data or responses are processed in a way that causes an arithmetic overflow and leads to unsafe memory handling. Available reporting associates the issue with remote code execution in enterprise remote-management scenarios and identifies RRAS management interactions as the relevant attack surface. The vulnerability affects Windows 11 Enterprise hotpatch scenarios that required Microsoft update KB5084597, while standard Windows 11 devices received the fix through the March 2026 cumulative security update.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit/simulation lab with 2 files: a README and one Python script. The README describes an educational lab for simulating Windows 11 RRAS-related vulnerabilities (CVE-2026-25172, CVE-2026-25173, CVE-2026-26111) in an isolated virtual network, including example attacker/victim IPs and patch/build guidance. The code file, rras_exploit.py, is the main entry point and implements a simple malicious TCP server using Python's socket module. When a client connects, it sends a crafted binary payload composed of a fixed header, the maximum 32-bit unsigned integer (0xFFFFFFFF) packed little-endian, and 1024 bytes of padding. The intended capability is to simulate an integer-overflow-triggering malformed RRAS response that could cause denial of service or abnormal behavior on a vulnerable Windows 11 RRAS management component. Notably, the script prints that it is starting on port 1723, but actually binds to TCP port 445, which is an inconsistency that may indicate either a bug or incomplete adaptation of the PoC. There is no shell payload, persistence, lateral movement, or post-exploitation logic; it is a basic malicious service PoC rather than a full weaponized exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An additional vulnerability in the Windows RRAS management tool that increases the risk of remote code execution during interactions with malicious servers.
An additional Windows RRAS management tool vulnerability that may allow code execution under certain conditions and increases the overall risk posed by the related RRAS flaws.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool affecting certain Windows 11 Enterprise hotpatch-enrolled devices used for remote server management.
A remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS) management tool that can be triggered when a domain-joined user connects to a malicious server via the RRAS Snap-in.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.