The vulnerability stems from insufficient granularity of access control in the Windows Event Logging Service. An attacker with authorized rights can trigger the service to run arbitrary code through the network, potentially compromising system integrity and confidentiality. The weakness is classified as CWE‑1220, reflecting an access‑control failure that allows privileged operations without proper authorization checks.

This flaw affects a broad range of Microsoft Windows products, including Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 24H2, 25H2 and 26H1, as well as Windows Server 2012 (both Standard and R2, Server Core installations), Windows Server 2016, 2019, 2022, and 2025 releases. All listed builds across x86, x64, ARM64 architectures are impacted.

The CVSS score of 8 indicates a high severity attack that can lead to remote code execution. The EPSS score of less than 1% suggests that exploitation is currently rare but not impossible. The vulnerability is not yet catalogued in the CISA KEV list, implying no confirmed mass exploitation yet. The likely attack vector is a remote network configuration or injection scenario within the Event Logging Service, exploiting the lack of granular permission checks. Because the attacker must have some authorized level of access, the impact is limited to those privileged users but can still lead to full system compromise if the attacker elevates privileges.