The vulnerability lies in incorrect input validation within the Windows Server Update Service. An unauthorized attacker who can reach the service over a network may send specially crafted requests that allow tampering with the service’s behavior. The specific effects are limited to the integrity and operation of the update distribution system, as the attacker can modify WSUS state or configuration through the service.

Affected are Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2, including both standard and Server Core installations. These versions are listed in the CNA affected‑products list and cover all 64‑bit editions of the operating system.

The CVSS score of 7.5 indicates high severity, while no EPSS data is available and the vulnerability is not listed in the KEV catalog, suggesting no widespread exploitation yet. Because the flaw is exploitable over the network and requires no authentication, any host with WSUS enabled and exposed can be targeted. This poses a significant risk to the integrity and availability of the update infrastructure in affected environments.