This vulnerability is an improper access control flaw in the Windows Routing and Remote Access Service (RRAS). An attacker who has authenticated locally with sufficient privileges can modify RRAS settings without proper authorization checks, potentially redirecting routing traffic or disrupting remote access services. The weakness permits unauthorized configuration changes rather than remote code execution or denial of service, but can still compromise network functionality for the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, and Microsoft Windows Server editions from 2012 through 2025, including Server Core installations. The vulnerability applies to both x86 and x64 architectures as well as ARM64-based Windows 11 systems.

The CVSS base score of 5.5 indicates a moderate severity. The EPSS score is not available, so current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a local privileged user compromising RRAS configuration, inferred from the description that the flaw requires authorized access. If an administrator with local rights is compromised, the attacker can alter routing policies, compromise network traffic, and undermine remote connectivity.