The vulnerability is an improper access control flaw in Microsoft PC Manager that permits an attacker who already has legitimate local access to bypass a built‑in security feature. This bypass enables the attacker to perform privileged operations that would normally be restricted, potentially compromising confidentiality or integrity of sensitive data or system settings. The weakness is classified as CWE‑284, improper authorization, indicating a failure to enforce expected permissions.

The affected product is Microsoft PC Manager. No specific version range is listed, so any installations of the software may be vulnerable until a remediation is applied.

The CVSS score of 7.8 indicates a high severity and the threat is local, requiring an authorized user. EPSS data is unavailable, so exploitation likelihood cannot be quantified, and the vulnerability is not currently listed in CISA’s KEV catalog. Classification as a local, authorized flaw means attackers already have some local presence, but the impact of bypassing a security feature can be significant. The most realistic attack path involves a malicious local user exploiting the flaw directly through the PC Manager application.