An incorrect authorization check in Windows Routing and Remote Access Service (RRAS) lets an attacker who is already authenticated on the system bypass a built‑in security feature. The vulnerability, identified as CWE‑863, enables local privilege escalation by allowing the attacker to alter RRAS behaviour or elevate privileges without proper verification of authorization.

The affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and all Windows Server editions from 2012 through 2025 (including Server Core installations).

The CVSS score of 5.5 reflects a moderate level of severity; there is no EPSS score published, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would require local access and existing privileges to exploit the flaw, and they would need to target RRAS specifically. Because the risk does not involve remote or widespread exploitation, it remains a moderate threat pending patch.