A failure in the protection mechanism of Windows Shell allows an unauthorized attacker to bypass a security feature over a network, which can be leveraged to execute arbitrary code or elevate privileges. The weakness is a failure to enforce a protection mechanism (CWE‑693). The impact includes loss of confidentiality, integrity, and availability, potentially allowing full system compromise if exploited from a remote location.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition. All listed editions are affected, both 32‑bit and 64‑bit or ARM64 where applicable.

The vulnerability has a CVSS score of 8.8 (high) and an EPSS score of 4 %, indicating a moderate probability of exploitation. It is listed in the CISA KEV catalog, confirming that known exploit activity exists. The attack vector is over the network, meaning a remote adversary can trigger the flaw by sending a crafted request to the Windows Shell service. No special privileges are required to exploit this once the target machine is reachable.