The Windows Boot Manager contains a protection mechanism failure that allows an authorized local attacker to bypass a security feature. This flaw is identified as a protection mechanism failure (CWE-693). Based on the description, it is inferred that the bypass could enable manipulation of boot configuration settings, thereby compromising boot-time integrity.

Affected products are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Microsoft Windows Server releases from 2012 to 2025, including both full and Server Core installations. All listed architectures (x86, x64, arm64) are impacted.

The vulnerability has a CVSS score of 7.9, indicating high risk. EPSS data is not available and the CVE is not listed in CISA KEV, suggesting no documented exploitation thus far. Exploitation requires authorized local access, so the attacker must have physical or administrative local presence. Because the flaw undermines boot integrity, it represents a significant local security feature bypass.