Windows RRAS CVE-2026-49791

Exploitation requires local, authenticated access to a host where the Routing and Remote Access Service is present and reachable by the attacker's context - the CVSS vector AV:L/PR:L confirms the attacker must already hold a low-privilege account or code-execution foothold on the machine, so this is not remotely exploitable on its own. The attacker must be able to create filesystem links (symlinks/junctions/hard links) in a location the RRAS privileged operation will resolve, and must be able to trigger that operation. Limiting factors that reduce real-world risk: no network vector, no path from an unauthenticated attacker, dependence on the RRAS service being installed/running (common on VPN/routing servers, not on all endpoints), and the current absence of public exploit code (EPSS 0.28%, SSVC exploitation none, not automatable, not in KEV). It is most relevant on multi-user, terminal-server, and Server Core deployments where untrusted low-privilege users share the machine.

The signals are internally consistent and point to a moderate, patch-on-schedule priority rather than an emergency. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8 (High): exploitation is local (AV:L) and requires an existing low-privilege foothold (PR:L), but no user interaction, with total confidentiality/integrity/availability impact - matching SSVC's 'Technical Impact: total'. Countering the high severity, EPSS is only 0.28% (20th percentile), SSVC lists 'Exploitation: none' and 'Automatable: no', KEV does not list it, and no public POC is identified - so real-world weaponization risk is currently low. The main caveat is that link-following EoPs in Windows are a well-trodden research area and frequently become reliable local exploits after patch diffing; the low EPSS reflects current absence of public code, not inherent difficulty. Net: prioritize for standard monthly patching, escalating for multi-user, terminal-server, and shared-workstation hosts where local low-privilege attackers are realistic.

A standard (non-admin) user or a low-privileged process that has already landed on a Windows host that runs RRAS plants a symbolic link or NTFS junction in a location the service will access, then triggers the privileged RRAS file operation so it follows the link into a protected path. By redirecting that write, the attacker overwrites or creates a file executed with SYSTEM privileges, escalating from limited user to full control of the machine. No public POC is identified at time of analysis, and the local-only vector with total technical impact makes this a classic post-compromise privilege-escalation step.