CVE-2017-11885: Windows RRAS service improper input validation remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityA public exploit exists and EPSS is high, but exploitation requires high privileges and high attack complexity, keeping it below critical.

What it is

The Windows Routing and Remote Access Service (RRAS) mishandles requests, allowing remote code execution through improper input validation (CWE-20). The flaw affects a wide range of Windows client and server versions, and because RRAS is a network-facing service, a successful exploit can compromise the host.

Impact

An attacker who can reach the RRAS service and authenticate can execute arbitrary code with the service's privileges, potentially taking full control of the affected system.

Attack surface

The vulnerability is network-reachable (AV:N) but requires high privileges (PR:H) and high attack complexity (AC:H), with no user interaction (UI:N). An attacker must already hold valid credentials with sufficient rights to send crafted requests to the RRAS service.

Exploitation

CVE-2017-11885 is not listed in CISA KEV, but a public Exploit-DB entry (44616) exists and EPSS shows a 30-day probability of 0.45521 (98.7th percentile), indicating meaningful exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the vendor advisory for CVE-2017-11885 as the first action.
• Disable or stop the Routing and Remote Access service on hosts that do not require it.
• Restrict network access to RRAS-related ports and management interfaces to trusted administrative networks.
• Enforce least privilege so that only necessary accounts can interact with the RRAS service.
• Monitor for and remove unsupported or end-of-life Windows versions listed as affected.

Detection

• Monitor RRAS service logs and Windows event logs for unexpected crashes, restarts or error patterns.
• Alert on unusual network connections to RRAS ports from non-administrative hosts or unexpected source addresses.
• Hunt for suspicious child processes spawned by the RRAS service or its host process.
• Review authentication logs for anomalous privileged access to RRAS management interfaces.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.