This vulnerability is an instance of improper authentication (CWE‑287), allowing an unauthorized local attacker to spoof legitimate Active Directory accounts. The flaw can be used to impersonate domain users without valid credentials, thereby accessing resources that rely on AD authentication and potentially compromising the integrity of the authentication system.

Affected systems include Microsoft Windows client operating systems such as Windows 10 releases 1607, 1809, 21H2, 22H2, and Windows 11 releases 23H2, 24H2, 25H2, 26H1, 22H3, 26H1, as well as Windows Server editions 2016, 2019, 2022, 2025, and 23H2 in both standard and Server‑Core installations.

The CVSS score of 6.2 indicates moderate severity, and no EPSS score is publicly available; it is also not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to have physical or local user access to the system. Exploitation allows the creation of a spoofed account that can be used for unauthorized access, lateral movement, or compromising critical resources within the domain.