CVE-2026-49791

What it actually does

CVE-2026-49791 is a local privilege escalation flaw in Windows Routing and Remote Access Service (RRAS) caused by improper handling of links before file access. A low-privileged authenticated local attacker can abuse symbolic links, junctions, hard links, or other reparse-point behavior so that RRAS performs a privileged file operation against an unintended target. Because RRAS runs with elevated Windows privileges, successful exploitation can allow modification or destruction of protected files, resulting in high integrity and availability impact. The CVSS vector indicates local access is required, attack complexity is low, user interaction is not required, and confidentiality impact is not expected.

Why it matters to the business

An attacker who already has a basic local foothold on an affected Windows workstation or server may be able to turn that foothold into administrative-level control or disrupt system operation. This is most relevant for Windows systems where RRAS is installed, enabled, or reachable by local users, including VPN, routing, remote access, and server infrastructure. Although the current EPSS score is low and the vulnerability is not listed in CISA KEV, privilege escalation flaws are commonly chained with phishing, malware, exposed remote access, or credential theft to complete compromise. Organizations should prioritize patching internet-facing remote access servers, shared servers, domain-adjacent systems, and workstations used by administrators.

How an attack unfolds

An attacker first obtains low-privileged local access to an affected Windows system. They then identify an RRAS file operation that can be influenced through an attacker-controlled path or object. The attacker creates a filesystem link such as a symbolic link, junction, hard link, or reparse point that redirects RRAS from the expected file location to a protected file or directory. When the attacker triggers the vulnerable RRAS behavior, the service resolves and follows the link before performing the file operation. Because RRAS operates with elevated privileges, the action occurs against the attacker-selected protected target. Depending on the reachable file operation, this can be used to overwrite, modify, or delete privileged files, leading to local privilege escalation or denial of service. There is no indication from the provided data that this vulnerability is currently exploited in the wild, and no named threat actor activity is provided.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-49791 for all affected supported Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025 where applicable. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Update Catalog, or endpoint management tooling to confirm the July 2026-or-later security update containing this fix is installed. If immediate patching is not possible, reduce exposure by disabling RRAS where it is not required, removing the RRAS role from systems that do not need routing or remote access functionality, restricting local logon rights, limiting interactive access to servers, and monitoring for suspicious filesystem link creation by non-administrative users. Because this is a local privilege escalation issue, compensating controls should focus on preventing initial local access and constraining low-privileged users from executing arbitrary tools.

How to confirm the fix worked

Confirm the applicable Microsoft security update is installed on each affected Windows version by checking Windows Update history, installed hotfixes, endpoint management compliance data, or vulnerability scanner results. Verify whether the Routing and Remote Access role or RemoteAccess service is installed and enabled, and prioritize validation on those systems. Confirm the RemoteAccess service is disabled or removed on systems where it is not needed. Run authenticated vulnerability scans after patch deployment to verify the CVE is no longer reported. For high-risk systems, review filesystem permissions on RRAS-related working directories and confirm non-administrative users cannot create links or files in privileged service paths. Where feasible, perform controlled validation in a test environment by confirming that known link-following attack patterns against the vulnerable RRAS workflow no longer result in privileged file modification.

Typical attack path

1. Gain low-privileged local access to an affected Windows system.
2. Confirm RRAS is present, installed, enabled, or otherwise exposing the vulnerable local behavior.
3. Prepare an attacker-controlled filesystem object such as a symbolic link, junction, hard link, or reparse point.
4. Point the link to a protected file or directory that RRAS would not normally allow the attacker to modify.
5. Trigger the vulnerable RRAS file-access workflow.
6. Leverage the privileged RRAS file operation to alter or remove the chosen target.
7. Use the resulting arbitrary privileged file operation to escalate privileges, maintain access, or disrupt system operation.

How to detect it

Detection should focus on signs of attempted local privilege escalation and abuse of filesystem links around RRAS activity. Review Windows Security logs for suspicious process creation, privilege changes, protected-file permission changes, new service creation, scheduled task creation, and local account changes after RRAS-related activity. Useful events include Security 4688 for process creation, 4670 for permission changes, 4672 for special privileges assigned, 4697 for service installation, 4698 for scheduled task creation, 4720/4732 for account or group changes, and System 7045 for new service installation. If Sysmon is deployed, review Event ID 1 for process creation, Event ID 11 for file creation, Event ID 12/13/14 for registry changes, Event ID 15 for alternate data streams, and Event ID 22 for suspicious DNS activity following suspected escalation. Investigate non-administrative users creating symbolic links, junctions, hard links, or reparse points shortly before privileged file modifications by RRAS or svchost-hosted RemoteAccess activity. Also examine RRAS operational logs, RemoteAccess-related Windows event channels, endpoint telemetry, and file integrity monitoring for unexpected modification or deletion of protected files. Because no public exploitation artifacts, actor-specific indicators, or exploit-specific filenames were provided, detection should be behavior-based rather than IOC-only.

What your security team should do

• Patch affected Windows systems with the Microsoft security update addressing this vulnerability, prioritizing servers running RRAS, VPN, routing, or remote access functions.
• Inventory systems where RRAS or the RemoteAccess service is installed or enabled; remove or disable RRAS where there is no business requirement.
• Prioritize remediation on systems that are internet-facing, administrator workstations, jump servers, domain-adjacent servers, and multi-user Windows servers.
• Restrict local and interactive logon rights to reduce the number of users who can reach the local attack surface.
• Monitor for suspicious creation of symbolic links, junctions, hard links, or reparse points by non-administrative users, especially near service-managed directories.
• Review endpoint detection coverage for local privilege escalation behavior, including abnormal protected-file modification by svchost-hosted services.
• After patching, run authenticated vulnerability scans or compliance checks to confirm the update is present across affected Windows 10, Windows 11, and Windows Server versions.
• Treat exploitation as a potential post-compromise activity: if suspicious signs are found, investigate the initial access vector as well as the privilege escalation event.