Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. This creates a risk that attackers could send forged traffic that the shell interprets as legitimate, potentially enabling spoofed authentication or command injection. The vulnerability is classified as CWE-693, indicating a failure of a protection mechanism.

Affected are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations.

The CVSS score of 4.3 indicates low severity, but the EPSS score of 5 % demonstrates a moderate probability of exploitation. Because the vulnerability has been listed in the CISA KEV catalog, it has either been exploited in the wild or is expected to be. The attack vector inferred from the description is network‑based: an attacker who can transmit crafted packets to the vulnerable Windows Shell component could spoof network traffic to masquerade as another host or service.