Improper access control within the Microsoft Management Console enables an authorized local user to increase their privileges. By exploiting this flaw, an attacker can gain full control of the affected system, including the ability to read, modify, or execute any code, and potentially compromise all local resources.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 22H3; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2. All listed operating systems and their Core installations are affected.

The CVSS score of 7.8 indicates high severity. While EPSS is not provided, the vulnerability is not currently listed as a known exploited vulnerability. Exploitation requires local access to the Management Console, meaning an attacker must already have some level of authorized access. The combination of high severity, local attack vector, and lack of mitigation updates places impacted systems at significant risk of privilege escalation.