An incorrect default permission setting in the Windows Server Update Service allows an attacker who already has local access to the server to gain elevated privileges on the system. The flaw is classified as an authorization issue, specifically CWE-276. With elevated rights, the attacker could install malware, modify system settings, or move laterally within the network. The impact is confined to compromised servers but can lead to broader incidents if the elevated accounts are used for further exploitation.

Microsoft Windows Server 2012, Windows Server 2012 (Server Core), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core), Windows Server 2016, Windows Server 2016 (Server Core), Windows Server 2019, Windows Server 2019 (Server Core), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core). All 64‑bit editions of these operating systems are affected.

The vulnerability has a CVSS score of 7.5, indicating moderate to high severity. The EPSS score is currently unavailable, and the issue is not listed in the CISA KEV catalog. Exploitation requires local privileged access but benefits from incorrect default permissions, meaning an attacker with basic user rights can elevate their privileges without additional network traversal. The risk is primarily to systems that have the Windows Server Update Service installed and left enabled.