This vulnerability arises from improper access control in Windows Administrator Protection, enabling an authorized attacker to circumvent a critical security feature on the host. The weakness, identified as CWE‑284, permits the attacker to execute actions that would normally be restricted, effectively elevating their privileges within the local environment. By bypassing this protection, the attacker can gain unchecked access to system resources and potentially compromise confidential data or system integrity.

Affected are Microsoft Windows 11 Version 24H2, Version 25H2, and Version 26H1. These releases are listed as vulnerable in the official Microsoft advisory, and the issue has been documented for ARM64 and x64 architectures. No additional versions have been enumerated as impacted.

The CVSS score of 7.8 marks this vulnerability as high severity, indicating significant potential damage if exploited. The exploitation probability score (EPSS) is not available, so the likelihood remains uncertain, and the vulnerability is not yet catalogued in CISA’s KEV. The attack is local, requiring the attacker already have authorized access to the system, but once that baseline is met, they can bypass the feature without further escalation. Vigilance is advised, especially for systems that rely heavily on Administrator Protection for hardening.