This vulnerability, identified as CWE-59 (Improper Link Resolution Before File Access), affects Windows 10 Version 1607 (build 10.0.14393.0) specifically in the Routing and Remote Access Service (RRAS). An authorized attacker with local access can exploit improper handling of symbolic links or similar link types before file access to escalate privileges. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector local, low attack complexity, and requiring privileges but no user interaction. Microsoft has published an official fix to address this issue.

An authorized local attacker can leverage this vulnerability to elevate their privileges on the affected system, potentially gaining higher-level access than intended. The vulnerability does not impact confidentiality but can affect integrity and availability of the system. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49791 for detailed patch information and deployment guidance.