The vulnerability consists of an improper resolution of path equivalence in the Windows MapUrlToZone function. An attacker can use this flaw to bypass a security feature that otherwise protects against certain network‑initiated actions. The flaw does not explicitly state that it enables code execution or privilege escalation, but it does allow operations that would normally be restricted by the security feature.

Affected systems include multiple Microsoft Windows operating systems. Windows client editions start with Windows 10 Version 1607 and continue through Windows 10 Version 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 22H3. All listed configurations, including Server Core installations, are impacted. Windows Server editions from Server 2012 and Server 2012 R2 to Server 2016, Server 2019, Server 2022, Server 2025, and Server 2025 (Server Core) are also affected.

The CVSS score of 7.5 reflects a moderate to high severity impact. The EPSS score of less than 1% indicates that exploitation activity is currently uncommon. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is a remote, unauthenticated network attacker who leverages the flaw in MapUrlToZone to bypass the security feature.