A failure in a protection mechanism of the Windows Shell permits an unauthorized attacker to spoof network communications, potentially allowing the attacker to impersonate legitimate network services or devices. The vulnerability can lead to data that is trusted by other systems being delivered or received from an attacker-controlled source, thereby undermining authentication and confidentiality. The primary weakness associated with this issue is identified as CWE‑693—an improper handling of authenticated session data or state.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2 (Server Core and full installations). All affected releases are listed in the CNA vendor information.

The assessed CVSS score is 4.3, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that there is no current evidence of widespread exploitation. Based on the description, the attack vector is likely network-based, requiring an attacker to send crafted packets or payloads to a system over a communication channel that permits Windows Shell interaction. Because the issue does not provide remote code execution or privilege escalation, the overall risk to a single user or isolated environment remains limited, but organizational deployments exposed to untrusted networks may suffer from impersonation or credential compromise.