Security readout for executives and security teams
Plain-English summary
A user who already has authorized, low-level local access to an affected Windows system may abuse improper RRAS access controls to gain higher privileges. Successful exploitation could let that user compromise sensitive data, alter the system, or disrupt services. This is a high-severity post-compromise risk, not a remote unauthenticated entry point.
Executive priority
Treat as a high-priority patching item, especially on servers and multi-user systems. It does not appear to provide initial remote access, but it could convert an existing low-privilege foothold into full system compromise. Remediate within the organization's high-severity timeline and accelerate where local access is broadly available.
Technical view
CVE-2026-20843 is a CWE-284 improper access-control flaw in Windows Routing and Remote Access Service. CVSS 3.1 is 7.8: local access, low complexity, low privileges, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact. The supplied evidence does not identify additional prerequisites or the resulting privilege level.
Likely exposure
Exposure includes the listed Windows 10, Windows 11, and Windows Server releases, including specified Server Core installations. Organizations should inventory those versions and confirm Microsoft applicability, particularly where RRAS is installed or used. The source bundle does not establish whether RRAS enablement is required for exploitation.
Exploitation context
The attacker must already be authorized and able to act locally with low privileges. No user interaction is required, and attack complexity is rated low. The supplied record is not in CISA KEV and provides no evidence of active exploitation or public exploit availability.
Researcher notes
The source supports a local, low-complexity privilege-escalation path caused by improper access control. It does not disclose the vulnerable operation, required RRAS state, resulting privilege level, affected component details, or exploitation telemetry. Avoid inferring those details; validate applicability and remediation against Microsoft's advisory.
Mitigation direction
- Review Microsoft's CVE advisory and deploy the applicable vendor security update.
- Prioritize affected servers, shared systems, and devices accessible to lower-privileged users.
- Restrict unnecessary local access and administrative pathways while remediation is pending.
- Review whether RRAS is required and follow Microsoft guidance before changing service configuration.
Validation and detection
- Inventory systems matching the listed Windows products and versions.
- Use Microsoft's advisory to confirm applicability and the required security update for each system.
- Verify successful update installation using approved endpoint or patch-management evidence.
- Confirm affected assets no longer report the vulnerability after authenticated rescanning.
- Review local account and privilege-change telemetry for suspicious activity.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-20843 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.85.9microsoftVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Windows Routing and Remote Access Service (RRAS) Elevation of Privilege VulnerabilityCVE reference, microsoft · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.