CVE-2026-70057
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to bypass a security feature locally.
Risk Assessment
An attacker could bypass access controls, potentially leading to unauthorized access to network resources.
Recommendation
Apply Windows security updates and restrict access to the RRAS service.
Other vulnerabilities in Windows RRAS
See all- CVE-2026-72950High
Remote Code Execution vulnerability in Windows Routing and Remote Access Service (RRAS) allows an attacker to gain unauthorized access to the victim's machine.
- CVE-2026-72939Medium
Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network.
- CVE-2026-71353High
Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-71351High
Double free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-62819High
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
- CVE-2026-50451High
In Windows Routing and Remote Access Service (RRAS), missing authentication for a critical function allows an authorized attacker to elevate privileges locally.
- CVE-2024-30095High
Remote code execution vulnerability in Windows Routing and Remote Access Service (RRAS). Allows an unauthenticated attacker to execute arbitrary code remotely in the context of the RRAS service.
- CVE-2024-30094High
A vulnerability in Windows Routing and Remote Access Service (RRAS) allows remote code execution. An unauthenticated attacker could exploit this flaw to take control of the affected system.
Original NVD description (English source)
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to bypass a security feature locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS