Windows RRAS EUVD-2026-99506

Exploitation requires the Routing and Remote Access Service (RRAS) role/feature to be installed and running on the target Windows host - this is not enabled in default Windows client or server installations, which substantially narrows the attack surface. The attacker must additionally hold valid credentials for a low-privileged local account (PR:L) and have local access to the machine (AV:L); there is no remote vector and no user interaction is required (UI:N). The primary limiting factors are therefore: mandatory pre-existing authenticated local access, and the non-default presence of the RRAS role. Affected and patched builds span the full supported Windows range (e.g. Windows Server 2012 <6.2.9200.26434 through Server 2025 <10.0.26100.33650 and Windows 11 24H2/25H2/26H2 <10.0.26x00.9711).

This is a genuinely moderate, low-urgency issue - not a top priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a locally-exploitable flaw requiring the attacker to already hold valid low-privilege credentials on the host; it is not remotely reachable. Impact is limited to confidentiality (C:H/I:N/A:N), consistent with an out-of-bounds read that leaks memory contents (CWE-125) rather than enabling code execution or tampering. All exploitation signals align toward low real-world risk: CISA's SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no KEV listing and no public exploit identified at time of analysis. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. There are no conflicting signals - the local vector, low privileges-required, partial technical impact, and absence of exploitation evidence are mutually consistent. The only amplifying factor is deployment breadth (Windows), but that is offset by the requirement that the RRAS role be installed and by the local-access precondition.

A local attacker who already has a low-privileged foothold on a Windows host running the Routing and Remote Access Service triggers the vulnerable RRAS code path to read out-of-bounds memory, disclosing adjacent process memory that may contain sensitive data such as tokens or configuration secrets. No public exploit code is available, and the attack cannot be performed remotely or without an existing authenticated account. Given AV:L/AC:L, exploitation is technically straightforward once local access is obtained, but the local-access and RRAS-role prerequisites sharply limit opportunity.