Improper access control in Windows Routing and Remote Access Service (RRAS) permits an attacker who already has legitimate access to the system to elevate their privileges locally. This weakness allows the attacker to gain higher privileges than intended, potentially enabling full control of the compromised machine. The vulnerability is a classic example of an access control flaw, classified as CWE-284.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 22H3; Windows Server 2008 R2 SP1 (both full and Server Core), Windows Server 2008 SP2, Windows Server 2012 and 2012 R2 (both full and Server Core), Windows Server 2016, Windows Server 2019, Windows Server 2022 (including the 23H2 Server Core edition), and Windows Server 2025 (both full and Server Core).

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% shows a very low but non-zero probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector requires local presence and authorized access; the attacker must already be able to log on to the machine and then exploit the RRAS component to gain elevated rights.