An improper access control flaw in Windows Filtering Platform (WFP) allows an attacker who already has local authorized access to bypass a security feature. The vulnerability exploits CWE‑284, enabling the attacker to circumvent firewall‑like controls or other WFP‑based restrictions without requiring elevated privileges or remote access.

The flaw affects multiple Microsoft Windows and Windows Server releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2. All affected builds are listed in the vendor’s advisory.

The CVSS score of 4.4 indicates a moderate risk, and the EPSS score is not currently available, so the likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local and requires the attacker to have authorized access to the system, such as a legitimate user or an application running with sufficient privileges. Exploitation would enable bypassing WFP‑based security controls, potentially leading to unauthorized network traffic or policy violations.