CVE-2026-62819

Windows RRAS is like the “front door” component used for routing and remote network access. This bug could let a remote attacker send crafted network input and then run their own code on the Windows machine, which can lead to a full takeover—similar to someone breaking into the front door and getting inside your office systems, not just stealing a password.

This matters if you run Windows 10, Windows 11, or any listed Windows Server versions and have the Windows Routing and Remote Access Service (RRAS) role enabled, installed, or reachable over the network.
It is a remote risk: an attacker only needs network access to reach the vulnerable RRAS functionality (for example, through internet-facing or otherwise reachable RRAS endpoints).

This is RED because RRAS remote code execution can lead to complete compromise once an attacker can reach the service, and the issue is receiving new security attention tied to a known threat actor.
Even though no public exploit code is currently on record and it’s not in the CISA KEV list, you should still patch now because waiting gives attackers time to adapt and test access paths in real environments.

1. Confirm exposure scope

   • Identify all machines running one of the affected Windows versions: Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025, and Windows Server 2012 R2.
   • For each, check whether RRAS is installed/enabled and whether RRAS endpoints are reachable from untrusted networks (internet or other outside networks).
   • If you use RRAS for VPN or remote access, confirm the exact entry points (public IPs, load balancers, NAT rules, firewall rules) that could be used to reach RRAS.

2. Check whether you’re already patched

   • Compare your installed Windows build to the fixed versions below and ensure your system is at or above the appropriate fixed build for its branch.

3. Upgrade to the fixed version (use the exact build shown for your release)

   • Windows 10 fixed builds include: 10.0.14393.9418, 10.0.17763.9115, 10.0.19044.7663, 10.0.19045.7663.
   • Windows 11 fixed builds include: 10.0.22631.7517, 10.0.26100.9106, 10.0.26200.9106, 10.0.28000.2704.
   • Windows Server 2016 fixed build: 10.0.14393.9418.
   • Windows Server 2019 fixed build: 10.0.17763.9115.
   • Windows Server 2022 fixed build: 10.0.20348.5440.
   • Windows Server 2025 fixed build: 10.0.26100.33222.
   • Microsoft’s update guide for installation guidance: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62819.

4. Temporary workaround if patching is delayed

   • If RRAS is not required for business operations, disable it (remove/disable the RRAS role) so it cannot be reached.
   • If RRAS is required, tightly restrict who can reach it: limit inbound access to only necessary IP ranges and approved management networks, and ensure there are no unnecessary internet-facing paths.

5. After patching

   • Verify the build number changed to the fixed level.
   • Review logs for unusual RRAS-related traffic patterns or repeated connection attempts leading up to and after the update.

6. What to monitor next

   • Additional advisories or evidence of exploitation in the wild (even if none is public right now) and any guidance expanding recommended mitigations.

CVE-2026-62819 is a Windows RRAS Remote Code Execution issue mapped to CWE-416 (Use After Free). The practical outcome of the weakness is that a remote attacker can send specially crafted network traffic to RRAS and cause code execution on the target.

Exploitation status: not listed in CISA KEV and no public exploit code is on record from the provided findings. Despite that, this CVE is receiving press attention, including association with a threat actor (Lazarus group) and a “new” patch cycle.

EPSS: a predicted likelihood was provided (trend flat), but public-facing urgency here is driven by the RED verdict and the remote-code-execution impact and attention signal rather than by prediction alone.

Attack vector (from the description + title): network-based interaction with Windows Routing and Remote Access Service, requiring the vulnerable service to be reachable from the attacker’s position.