Is CVE-2026-20868 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20868 being exploited in the wild.

How severe is CVE-2026-20868?

High severity, with a CVSS score of 8.8, published 13 January 2026.

Which products and versions are affected?

Microsoft Windows 11 22H3, 23H2, 24H2, 25H2; Microsoft Windows Server 2008 R2 Service Pack 1; Microsoft Windows 10 1607, 1809, 21H2, 22H2.

Is there a fix for CVE-2026-20868?

A patch was published on 2026-07-30: Microsoft updated the advisory with specific version information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20868 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-20868?

Check whether you run Microsoft Windows 11, Microsoft Windows Server 2008 R2 or Microsoft Windows 10 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20868: Microsoft Windows RRAS heap buffer overflow

CVE-2026-20868 · Severity: high · CVSS 8.8 · Published 2026-01-13

A security vulnerability has been identified in the Windows Routing and Remote Access Service (RRAS), a component used to provide routing and VPN services. An attacker could exploit this flaw over the network to gain unauthorized control of the affected system. This could lead to a complete compromise of the server, including data theft or service disruption. Organizations should apply the latest Windows security updates to mitigate this risk.

Technologies: Microsoft Windows 11, Microsoft Windows Server 2008 R2, Microsoft Windows 10. Vendors: Microsoft.

Quick answers

Is CVE-2026-20868 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20868 being exploited in the wild.
How severe is CVE-2026-20868?: High severity, with a CVSS score of 8.8, published 13 January 2026.
Which products and versions are affected?: Microsoft Windows 11 22H3, 23H2, 24H2, 25H2; Microsoft Windows Server 2008 R2 Service Pack 1; Microsoft Windows 10 1607, 1809, 21H2, 22H2.
Is there a fix for CVE-2026-20868?: A patch was published on 2026-07-30: Microsoft updated the advisory with specific version information Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20868 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-20868?: Check whether you run Microsoft Windows 11, Microsoft Windows Server 2008 R2 or Microsoft Windows 10 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the Microsoft Windows Routing and Remote Access Service (RRAS). The vulnerability is reachable over the network and does not require administrative privileges, though the CVSS vector suggests some level of user interaction may be required (UI:R). Successful exploitation allows for remote code execution (RCE) in the context of the service. Affected versions include various releases of Windows 10, Windows 11, and Windows Server 2008 R2. Microsoft has released security updates to address this issue, and administrators are advised to verify their build versions against the patched releases (e.g., 10.0.19045.6809 for Windows 10 22H2).

Affected products

Microsoft Windows 10 1607, 1809, 21H2, 22H2
Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
Microsoft Windows Server 2008 R2 Service Pack 1

Timeline

2026-01-13: disclosed: Initial NVD publication date
2026-07-30: patched: Microsoft updated the advisory with specific version information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.