An attacker that is not authenticated can exploit a flaw in the Windows Remote Procedure Call API, allowing the attacker to gain higher privilege levels on the affected system. The vulnerability is identified as a CWE‑287 authentication bypass, meaning the system incorrectly verifies caller identity. Because elevated privileges can be used to modify system settings, install software, or access sensitive data, the impact could expand to additional compromise or persistence if the attacker follows up with other exploits.

Microsoft Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server editions 2012 through 2025, including both standard and core installations. All of these product releases expose the RPC endpoint to adjacent networks and therefore are susceptible to this authentication bypass.

The CVSS score of 8 reflects a high severity that the flaw could let an attacker gain privileged access. The EPSS score of less than 1% indicates that, at present, the likelihood of exploitation is low and the flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to locate and communicate with the vulnerable RPC service over an adjacent network; once the connection is established, the improper authentication can be leveraged to elevate privileges, potentially enabling further actions by the attacker. Based on the description, it is inferred that the attack likely originates from an adjacent network host.