Executive brief
A security vulnerability exists in the Windows Routing and Remote Access Service (RRAS), which provides networking and connectivity features for Windows systems. An attacker who already has basic access to a computer could exploit this flaw to gain higher-level administrative privileges. This could allow them to bypass security restrictions, modify system files, or disrupt network operations.
Technical details
This vulnerability is classified as an improper link resolution (CWE-59) issue within the Windows Routing and Remote Access Service (RRAS). The flaw occurs when the service fails to properly validate or resolve file links (such as symbolic links or hard links) before performing file operations. A locally authenticated attacker with low privileges can exploit this behavior to redirect file access to a target file with higher permissions. Successful exploitation allows the attacker to achieve local privilege escalation (LPE), potentially gaining SYSTEM-level access. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All editions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory