Windows RRAS EUVD-2026-99141

Requires the Windows Routing and Remote Access Service (RRAS) role to be present on the host, and the attacker must already possess local, authenticated low-privileged access (PR:L) to the machine - there is no remote attack path (AV:L) and no user interaction is needed (UI:N). Exploitation limits: it cannot be triggered over the network, it grants only an integrity impact (I:H) with no confidentiality or availability effect, and it affects only systems within the listed Windows client and Windows Server build ranges that are below the patched versions. This is realistically a post-compromise security-feature bypass rather than an initial-access vulnerability.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally-exploitable authorization flaw (CWE-863) that requires an already-authenticated attacker and yields only an integrity impact (I:H) with no confidentiality or availability loss. The CISA SSVC decision framework aligns with a de-prioritized posture: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public proof-of-concept reported, so exploitation status is 'no public exploit identified at time of analysis.' EPSS score is NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap. All signals are mutually consistent (local vector, requires privileges, no automation, no observed exploitation), so there is no conflict to reconcile. The main caveat is the usual one for local privilege/security-feature bypass bugs: the real risk depends on an attacker first obtaining local authenticated access, after which this becomes a useful post-compromise step rather than an initial-access vector. Treat as routine patch-cycle priority, not emergency.

An attacker who already has valid, low-privileged local credentials on a Windows host running Routing and Remote Access Service abuses the incorrect authorization check to bypass a security feature that should have restricted the action. Because the vector is local (AV:L) with low attack complexity and no user interaction, exploitation is straightforward once a foothold exists, but it cannot be launched remotely. No public exploit code has been identified at time of analysis.