The vulnerability is an improper access control flaw in Windows Remote Access Connection Manager. It allows an attacker with local authenticated privileges to elevate their privileges on the same machine, potentially gaining full administrative control.

This flaw impacts Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, and 25H2; and multiple Windows Server releases including 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, and 2025, along with their Server Core installations.

The CVSS score of 7.8 indicates a serious local privilege escalation risk, although the EPSS score of less than 1 % suggests low likelihood of exploitation in the wild. The flaw is not listed in CISA KEV, implying no confirmed active exploitation. Attackers would need to be authenticated and authorized on the target system to exploit this weakness, after which they could gain elevated privileges and compromise the system's confidentiality, integrity, or availability.