Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. The flaw enables the sending of forged network traffic that the shell interprets as legitimate, allowing an attacker to impersonate another host or service without authentication. The resulting impact is a loss of authenticity and integrity for network communications handled by the shell.

Affected are Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, and 26H1; and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations.

The CVSS score of 4.3 indicates a low overall severity, but the EPSS score of 71% shows a high likelihood that attackers will attempt to exploit the flaw. The KEV listing confirms that this vulnerability has been actively exploited or is monitored closely. Because the vulnerability resides in the network stack of Windows Shell, a threat actor can send crafted packets to the vulnerable component in order to disguise traffic as originating from a legitimate host or service. Classified as CWE-693, the flaw reflects a failure of a protection mechanism rather than a logic or input‑validation issue.