Windows RRAS CVE-2026-50451

Requires the attacker to already hold valid low-privileged local access (CVSS PR:L, AV:L) on a Windows system where the Routing and Remote Access Service (RRAS) component is present - RRAS ships with all affected editions, though it is a role that may or may not be actively started. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors that constrain real-world risk: exploitation is local-only (not remotely reachable over the network), the attacker must first authenticate as some user on the box, SSVC rates it non-automatable, and the target must be running an unpatched build below the fixed versions listed in the EUVD data. This is an escalation primitive usable only after an initial foothold, not an unauthenticated remote entry point.

Signals are internally consistent and point to a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes low-complexity local exploitation by an already-authenticated low-privileged user with no user interaction, yielding total system compromise - matching the SSVC 'Technical Impact: total' rating. Countervailing signals lower urgency: EPSS is only 0.22% (13th percentile), SSVC 'Exploitation: none' and 'Automatable: no', and there is no public exploit identified at time of analysis and no CISA KEV listing. The local-only attack vector means this is a post-compromise escalation primitive rather than a remotely wormable flaw, so it belongs in the standard Patch Tuesday cycle prioritized for multi-user, RDP, and jump-host systems rather than an out-of-band emergency. No data is conflicting; the main unknown is real-world exploit maturity, which current evidence indicates is low.

An attacker who has already obtained an ordinary low-privileged account on a Windows host - for example via phished credentials, a compromised service account, or a foothold on a shared terminal/RDP server - locally invokes the unprotected RRAS function to bypass its missing authorization check. Because attack complexity is low and no user interaction is needed, the attacker reliably elevates to SYSTEM and takes full control of the machine. No public proof-of-concept is currently available, so exploitation would require original development.