CVE-2026-49791
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized user could exploit this vulnerability to gain higher privileges, potentially compromising network and data security.
Recommendation
Install the security update for Windows Routing and Remote Access Service (RRAS) from Microsoft.
Other vulnerabilities in Windows Routing and Remote Access Service (RRAS)
See all- CVE-2023-35367Critical
A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
- CVE-2023-35366Critical
A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
- CVE-2023-35365Critical
A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
- CVE-2026-20843High
Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.