Improper resolution of path equivalence in the WebDAV implementation allows an authorized attacker to craft requests that cause the server to treat distinct paths as equivalent, escalating privileges beyond the attacker’s original credentials. The flaw maps to CWE-22 (Path Traversal). If exploited, this can provide the attacker with administrator or system level access, potentially leading to a full compromise of the affected machine.

Affected systems include Microsoft Windows client and server products: Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), together with Windows Server 2012 through 2025, including Server Core installations. All listed builds are reported vulnerable by Microsoft.

The CVSS score of 8.8 indicates high severity, while the EPSS score of 1% denotes a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits at the time of publication. An attacker must already have network connectivity and prior authentication to a system exposing the WebDAV service; once those conditions are met, the flaw permits privilege escalation that could compromise the entire network.