Windows RRAS CVE-2026-96316

Exploitation requires the Windows Routing and Remote Access Service (RRAS) role to be installed and enabled on the target host, plus an existing local session with at least low-level privileges (CVSS PR:L) on that same machine - there is no remote vector (AV:L) and no user interaction is needed (UI:N). Limiting factors that reduce real-world risk: the attacker must already be authenticated and locally present, only integrity is affected (C:N/A:N), and RRAS is an optional role that is not enabled on default Windows installations, so hosts without the RRAS role configured are not exposed. Only the listed Windows 10/11 and Windows Server builds below the fixed versions are affected.

This is a moderate-severity, low-priority issue despite the confirmed vendor patch. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally-exploitable tampering flaw: the attacker must already have local access and at least low-level privileges (PR:L), with no confidentiality or availability impact and only an integrity impact (I:H). All exploitation signals point the same direction and reinforce the low-urgency reading: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with the local vector and single-impact profile. There is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent - there is no conflict between the CVSS vector, SSVC, and the description, all of which describe a local, authorized, integrity-only weakness. Mapped CWE-862 (Missing Authorization) matches the 'improper access control' description. The one caveat is a metadata discrepancy: the 'Authentication Bypass' tag overstates the issue, which is an authorization/access-control tampering flaw (CWE-862), not an authentication bypass - see confidence and data-quality notes.

An attacker who already has a local, low-privileged foothold on a Windows host running the RRAS role abuses missing authorization checks to tamper with RRAS-managed data or configuration they should not be able to modify. No remote access, user interaction, or administrative privilege is required beyond the existing low-privilege session. No public exploit code or active exploitation has been identified, so this is a theoretical local privilege-abuse scenario rather than an observed campaign.