CVE-2026-70570 is a high severity (CVSS 7.5) use after free in the Windows Routing and Remote Access Service (RRAS). The record describes remote code execution and unauthorized access to the victim machine. The fix is the Windows update named in the Microsoft Security Response Center entry for your Windows version.
What's affected
The record lists many Windows 10 releases, including 1607, 1809, 21H2 and 22H2, and the list continues past those. It gives no update numbers. The MSRC page loads by script, so confirm affected builds and fixed updates there.
The weakness is CWE-416. The vector is AV:A/AC:H/PR:N/UI:N: adjacent network, high complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. Adjacent means the attacker has to be on the same network segment, not anywhere on the internet.
The risk is concentrated on machines where the RRAS role is installed, but the record does not say the role is a requirement. Check MSRC for the exact conditions.
How to check if you're exposed
Find out whether the RRAS role or service is present on each server:
Get-WindowsFeature RemoteAccess
Get-Service RemoteAccess
On client editions, check the service state with the second command. A stopped or disabled service still needs the update where MSRC says the component is affected, but a running one is the first priority.
Then compare installed updates with the fixed update in MSRC using Get-HotFix. For fleets, use your update management compliance report.
Adjacent network exposure depends on segmentation, so review which hosts share a segment with RRAS servers.
free in-browser dependency scan is for application dependencies. For operating system updates, rely on your patch tooling.
What to do now
- Read the MSRC entry for CVE-2026-70570 and note the update for each Windows version you run.
- Find hosts with the RemoteAccess role or service enabled and patch them first.
- Install the update on the remaining Windows machines through your normal channel.
- Disable RRAS where it is not in use.
- Review network segmentation around servers that must keep RRAS running.
Why it matters
CWE-416 is use after free, which lets an attacker influence memory the program already released. RRAS runs with high privileges and parses network input, which is why a flaw in it draws attention even with a high complexity rating.
The adjacent attack vector reduces exposure compared with an internet facing bug, but flat internal networks are common. A device compromised on the same segment can reach the service. The practical lesson is to remove roles you do not use, because a service that is not installed cannot be attacked.
Quick check
What does adjacent network mean in the score?
The attacker must be on the same local network segment as the target, not on a remote network. It narrows who can attack, but it does not help on a flat internal network.
Sources
Last reviewed: 18 October 2026.
