CVE-2026-72950 is a high severity (CVSS 8.8) heap buffer overflow in the Windows Routing and Remote Access Service, which can lead to remote code execution. It affects several Windows 10 and Windows 11 releases. Install the Microsoft security update listed in the Update Guide entry.
What's affected
The record lists Windows 10 versions 1607, 1809, 21H2 and 22H2, and Windows 11 versions 23H2, 24H2, 25H2 and 26H1. The vulnerable component is Routing and Remote Access Service (RRAS).
The record gives no update package numbers, and Microsoft's page needs JavaScript, so I could not read it as text. Use the Update Guide to find the right update for your exact build, including any Windows Server releases it lists.
The vector includes user interaction, which is why the score sits at 8.8 rather than higher.
How to check if you're exposed
Find the Windows version and build.
winver
See whether the RRAS service exists and is running.
Get-Service RemoteAccess
If the service is stopped or disabled, the component is not active, though you should still install the update. Then check the installed updates against the Microsoft entry.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
What to do now
- Open the Microsoft Update Guide entry for CVE-2026-72950 and note the update for each of your Windows builds.
- Install the update through Windows Update, WSUS or your endpoint management tool.
- Prioritize systems where RRAS or VPN services are enabled.
- Disable RRAS on machines that do not need it.
- Confirm patch status with a follow up inventory.
Why it matters
The record maps this to CWE-122, a heap based buffer overflow. A program asks for a block of memory of one size and then writes more data into it than fits, damaging neighboring memory. When an attacker controls the data, that can be turned into code execution.
RRAS handles routing and VPN style connections, so it parses network input from outside. That is a typical place for memory safety bugs to matter. Disabling services you do not use is the standing defense, and patching is the fix.
The KEV flag in the record is false, and it does not describe exploitation.
Quick check
Which update fixes CVE-2026-72950?
It depends on your Windows build. The Microsoft Update Guide entry maps builds to updates.
Is RRAS on by default?
I cannot confirm that from the record. Check the service on your systems with the command above.
Sources
Last reviewed: 19 October 2026.
