The flaw stems from improper privilege management in Windows Remote Desktop Services, allowing an attacker who already has an authorized RDP session to elevate privileges locally. This represents a high‑severity local privilege escalation (CWE‑269) that can grant an otherwise limited user full system control on the target machine.

Affected products include Microsoft Windows 10 from version 1607 through 22H2, Windows 11 from 23H2 through 26H1, and Windows Server editions from 2012 all the way to 2025, covering all 32‑bit, 64‑bit, and ARM64 builds. Core installations of the server versions are also impacted.

With a CVSS score of 7.8 the vulnerability is deemed high severity, and an EPSS of 23 % indicates a moderate likelihood of exploitation. The attack requires an existing authenticated Remote Desktop session, but is amplified by its availability in the CISA Known Exploited Vulnerabilities catalog, implying that active exploitation is documented.