CVE-2026-49791: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-49791 Overview

CVE-2026-49791 is a local privilege escalation vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw is an improper link resolution before file access issue, commonly known as a link following vulnerability [CWE-59]. An authorized attacker with local access can abuse how RRAS resolves file paths through symbolic or hard links to write, modify, or access files in the security context of a privileged process. Successful exploitation grants the attacker elevated privileges on the affected host. Microsoft addressed the vulnerability across all supported Windows client and server platforms, including Windows 10, Windows 11, and Windows Server editions from 2012 through 2025.

Critical Impact
A local, authenticated attacker can escalate privileges to SYSTEM by abusing symbolic link handling in the RRAS service, resulting in full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-49791 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49791

Vulnerability Analysis

The Windows Routing and Remote Access Service (RRAS) provides routing, VPN, and dial-up remote access capabilities and runs with elevated privileges. CVE-2026-49791 stems from improper validation of file path targets when RRAS opens or writes to files during normal operation. Because the service does not adequately verify whether a target path is a symbolic link, junction, or hard link before performing file access, a low-privileged local user can pre-plant a link that redirects RRAS file operations to an attacker-chosen path.

When the privileged service follows the link, it performs the operation using its own token rather than the requesting user's token. This lets the attacker overwrite, create, or manipulate files in locations that would otherwise be protected, ultimately enabling arbitrary code execution in a higher privilege context.

Root Cause

The root cause is a link following weakness classified under [CWE-59]. RRAS opens files without using flags such as FILE_FLAG_OPEN_REPARSE_POINT or without verifying the canonical target of the path before acting on it. This time-of-check to time-of-use pattern allows an unprivileged process to substitute a link between path resolution and file access.

Attack Vector

Exploitation requires local access and low-privileged authentication on the target host. The attacker must be able to run code as a standard user and interact with locations that RRAS reads from or writes to, such as temporary paths or configuration directories. No user interaction is required beyond the attacker's own actions. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is approximately 0.28 percent.

Detailed technical exploitation code is not publicly documented. Refer to the Microsoft CVE-2026-49791 Advisory for vendor guidance.

Detection Methods for CVE-2026-49791

Indicators of Compromise

Creation of NTFS junctions, symbolic links, or hard links in directories accessed by the RRAS service (svchost.exe hosting RemoteAccess) by non-administrative users.
Unexpected file writes performed by RRAS-associated processes into system directories such as %SystemRoot%\System32 or Program Files paths.
New or modified DLLs, scripts, or scheduled tasks appearing shortly after RRAS service activity from a standard user session.

Detection Strategies

Monitor process and file-system telemetry for svchost.exe instances hosting the RemoteAccess service performing writes triggered by low-privileged user activity.
Alert on the use of CreateSymbolicLink, mklink, or reparse-point creation APIs by non-administrative processes targeting paths consumed by system services.
Correlate RRAS service starts and stops initiated by standard users with subsequent privileged file operations.

Monitoring Recommendations

Enable Windows object access auditing (Event IDs 4656, 4663, 4670) on RRAS working directories and configuration paths.
Track service configuration changes and unexpected restarts of the RemoteAccess service via Event ID 7040 and Service Control Manager logs.
Baseline normal RRAS file activity on servers where the role is intentionally enabled and flag deviations from that baseline.

How to Mitigate CVE-2026-49791

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-49791 Advisory to all affected Windows client and server systems.
Inventory hosts running the Routing and Remote Access Service and prioritize patching for internet-adjacent servers, VPN gateways, and multi-user systems.
Restrict interactive and remote logon rights on RRAS-enabled hosts to reduce the population of users who can stage a local exploit.

Patch Information

Microsoft has released security updates addressing CVE-2026-49791 for all supported versions of Windows 10, Windows 11, and Windows Server 2012 through 2025. Administrators should deploy the updates through Windows Update, Windows Server Update Services (WSUS), or their standard patch management workflow. Consult the Microsoft CVE-2026-49791 Advisory for the specific KB article that applies to each supported build.

Workarounds

Disable the RemoteAccess service on systems that do not require routing, VPN, or dial-up functionality until patches are applied.
Enforce the principle of least privilege and remove the SeCreateSymbolicLinkPrivilege from standard users where it is not required.
Use application control policies such as Windows Defender Application Control or AppLocker to restrict which binaries standard users can execute on RRAS-enabled hosts.

bash

# Check whether the Routing and Remote Access service is running
sc query RemoteAccess

# Disable the service on hosts that do not need RRAS functionality
sc config RemoteAccess start= disabled
sc stop RemoteAccess

# Review which principals hold SeCreateSymbolicLinkPrivilege
secedit /export /cfg C:\Temp\secpol.cfg
findstr /I "SeCreateSymbolicLinkPrivilege" C:\Temp\secpol.cfg