This vulnerability involves improper authentication within the Windows SMB Server component. An attacker who already has authorized access to the system can manipulate authentication checks to obtain higher privileges than intended. flaw can lead to a local privilege escalation, allowing the attacker to execute code with elevated rights, potentially compromising system integrity.

Affected products include Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2, Windows 11 releases 23H2, 24H2, 25H2, 22H3, and 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 Server Core edition. Both standard and Server Core installations are impacted.

The CVSS v3.1 score of 7.8 indicates a high severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The vulnerability is classified as CWE‑287, improper authentication. Exploitation requires an attacker who already has authenticated access or can gain temporary authorized credentials, after which elevation of privileges can occur. Because the flaw is not listed in the CISA KEV catalog, no known widespread exploits are reported.