An improper access control flaw in the Windows Remote Procedure Call API lets an attacker with local system access raise privileges. By using specific RPC calls, a user who can already authenticate to the machine can gain administrative rights, enabling full control over the server. The weakness is catalogued as CWE‑284, improper access control.

The flaw affects Microsoft Windows Server operating systems from 2012 through 2025, including both standard and Server Core editions. All builds of Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23 H2 release are affected. No more granular version constraints are published, so the entire nominal product lines are considered vulnerable.

The vulnerability carries a CVSS v3 base score of 7.8, indicating high severity. While no EPSS score is published, the flaw is not listed in the CISA Known Exploited Vulnerability catalog. The attack vector is local; the attacker must already have authenticated to the server to exploit the RPC service. When successfully exploited, the attacker can elevate to full administrator privileges, compromising confidentiality, integrity, and availability of the affected systems.