IRONSMITHINTEL
CRITICALCVSS9.8
|CVE-2023-35365|Auth: none|Reboot: required|Manual only

KB5028228: Windows Server 2012 R2 Security Update (July 2023)

A crafted packet to a Windows Server with the RRAS role enabled can give an attacker SYSTEM-level code execution with no credentials.

Published Jul 11, 2023 · Updated May 21, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

An attacker on the internet can send crafted packets to the RRAS endpoint and execute code as SYSTEM on the VPN / NAT server, with no credentials and no user interaction. From SYSTEM on an RRAS server the attacker controls the boundary device between the public internet and the internal corporate network — every VPN session, every routed packet, every authentication token that passes through.

How the attack works

The Windows Routing and Remote Access Service (RRAS) is the role that provides VPN, NAT routing, and dial-up access on Windows Server. RRAS is not installed by default, but when it is, it is almost always exposed to the internet — that is the role's entire purpose. A flaw in how RRAS handles incoming protocol traffic lets a remote attacker send crafted packets and execute code in the service context. One of three closely related RRAS RCEs (CVE-2023-35365, CVE-2023-35366, CVE-2023-35367) patched together in July 2023.

Am I affected?Quick check

Probably yes if any of these apply:

●Windows Servers with the Routing and Remote Access Service role enabled (VPN gateways, DirectAccess servers, NAT routers)

Affected OS versions

Windows Server 2012 R2
Real-world incidentsWhat we've seen

A nation-state actor or a ransomware affiliate scans for internet-facing RRAS endpoints — easy to find because they advertise themselves through standard ports. They send the crafted packet, land SYSTEM on the VPN gateway, and from that pivot have the same network access as every legitimate VPN user — which on most networks is essentially "trusted." RRAS RCEs are the modern equivalent of "compromise the firewall."

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB5028228

Manual remediation steps

Decide if you need the RRAS role at all

The Routing and Remote Access Service is not installed by default. If you are not using this server as a VPN gateway, NAT router, or DirectAccess endpoint, the strongest mitigation is to remove the role entirely:

Get-WindowsFeature -Name RemoteAccess | Where-Object Installed
# To remove:
# Uninstall-WindowsFeature -Name RemoteAccess

If RRAS must stay enabled, apply the patch below.

Prerequisites

    1
    Local administrator on the target server
    1
    Maintenance window with reboot capacity
    1
    Current backup or snapshot you can roll back to
    1
    Network path to Windows Update / WSUS / Microsoft Update Catalog

Estimated time

20–40 minutes per server (download + install + reboot)

Reboot required

Yes — install the cumulative update and reboot the server before the fix is active.

Steps

1. Confirm the server is missing the patch

Get-HotFix -Id KB5028228 -ErrorAction SilentlyContinue

2. Install the update — pick one channel

Windows Update / WSUS (preferred):

UsoClient ScanInstallWait
# (or use your standard WSUS / SCCM / Intune deployment for KB5028228)

Manual download (offline / air-gapped):

1
Open Microsoft Update Catalog: https://catalog.update.microsoft.com/Search.aspx?q=KB5028228
2
Download the MSU for Windows Server 2012 R2 that matches your architecture (x64).
3
Copy the .msu file to the server and run as Administrator.

3. Reboot

Restart-Computer -Force

Verification

Get-HotFix -Id KB5028228
[System.Environment]::OSVersion.Version

Rollback

wusa.exe /uninstall /kb:5028228 /quiet /norestart
# Reboot after uninstall

Removing a cumulative update also removes every fix it delivered — prefer rolling forward.

Notes

    1
    This entry covers Windows Server 2012 R2 specifically (KB5028228). Other Windows Server versions have their own KB for CVE-2023-35365.
    1
    Reference advisories: MSRC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35365 and NVD https://nvd.nist.gov/vuln/detail/CVE-2023-35365.
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2023-35365↗ MSRC Advisory↗ NVD↗ KBKB5028228