Improper input validation in Windows Server Update Service allows an attacker to execute code over the network. This flaw can be exploited by an unauthenticated threat actor to run arbitrary code with high privileges, potentially taking full control of the affected system. The weakness is a classic CWE‑20 vulnerability, allowing malicious input to bypass validation checks and corrupt execution paths.

The vulnerability impacts a wide range of Microsoft Windows operating systems. It includes Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 22H3; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025 and a variety of Server‑Core installations. These systems all run the Windows Server Update Service (WSUS) component, which is the source of the flaw.

The CVSS score is 8.1, indicating a high severity impact. EPSS is reported as less than 1 %, showing that, as of now, the probability of exploitation remains low. However, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation. Attackers can likely reach the vulnerable WinWSUS service from any machine with network access to the WSUS server, without needing authentication. Once the flaw is leveraged, code would execute with the privileges of the WSUS account.