Improper privilege management in Windows Group Policy permits an attacker who has already compromised an account or device to raise their privileges to local administrator or higher. The weakness, identified as CWE‑269, allows the attacker to bypass intended access controls without external assistance or network exposure. The impact is that the attacker can install malware, modify system settings, and exfiltrate data or pivot to other systems once the privilege elevation succeeds.

The vulnerability affects a broad range of Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2, 25H2 and 26H1; and Windows Server 2012 (Full installation), Windows Server 2012 (Server Core installation), Windows Server 2012 R2 (Full installation), Windows Server 2012 R2 (Server Core installation), Windows Server 2016 (Full installation), Windows Server 2016 (Server Core installation), Windows Server 2019 (Full installation), Windows Server 2019 (Server Core installation), Windows Server 2022 (Full installation), Windows Server 2022 (Server Core installation), Windows Server 2025 (Full installation), and Windows Server 2025 (Server Core installation).

The CVSS score of 7.8 indicates a high severity, and the EPSS score of < 1% results in a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying that there are no known exploits in widespread use as of this analysis. Based on the description, it is inferred that attackers need local access or the ability to log on to the target machine to leverage the flaw; no remote activation or network privilege is required. In environments where users remain confined to the machine in which the attacker operates.