An authorization flaw in the Windows Client‑Side Caching (CSC) Service permits an attacker with local, authorized access to read data that the service protects. The vulnerability emerges from improper access control checks within the CSC Service’s handling of cached items, allowing a local user to extract information that should be restricted to a more privileged context. This exposure does not lead to remote code execution or privilege escalation on its own, but it can leak sensitive data stored in the client‑side cache.

Microsoft Windows operating systems from Windows 10 version 1607 up through Windows 11 version 25H2, including Server 2008 R2 SP1, Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, Server 2025, and the 23H2 Server edition are all impacted. Versions are listed by major release in the CNA vendor product list and match the corresponding CPE identifiers provided.

The CVSS score of 5.5 classifies the flaw as moderate severity; the EPSS score of less than 1 % suggests a very low probability of active exploitation at this time, and the vulnerability is not in CISA’s KEV catalog. An attacker must already possess local, authorized credentials, and the vulnerability is exploitable only within the same workstation or server, making the attack vector local. Given these constraints, the risk is moderate but limited by the need for privileged local access.