Improper privilege management in Windows Group Policy permits an attacker who already has local authorization to elevate their privileges. By manipulating policy settings, the attacker can gain higher rights on the system, potentially allowing them to execute arbitrary code, install software, or access sensitive data. The vulnerability is classified as CWE‑862 and can compromise confidentiality, integrity, and availability of the affected machines.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server editions from 2012 R2 through 2025, including both standard and core installations, are all impacted. Devices running these operating systems that use Group Policy management are susceptible.

The CVSS score of 7.8 indicates a moderate‑to‑high severity, and the vulnerability is not yet listed in the CISA KEV catalog, but an attacker with local access can exploit it by editing Group Policy objects to increase their privileges. Because EPSS is not available, the current reported exploit probability is unclear, yet the capability to attain elevated privileges without higher privileges makes it a serious risk for environments that rely on local administration. Mitigating the exposure requires applying the vendor’s fix and enforcing strict access controls.