The vulnerability is due to a missing authentication check in a critical Windows SmartScreen function, enabling an authenticated user to alter or disable the SmartScreen protection mechanisms locally. This compromise can undermine the system’s ability to detect malicious content, thereby allowing further malicious activity to bypass the browser’s filtering policies.

Affected Microsoft Windows releases include Windows 10 1809, 21H2, and 22H2; Windows 11 version 23H2, 24H2, 25H2, 26H2, and 26H1 (the 23H2 repeat is a duplicate listing); as well as Windows Server 2019 (standard and Server‑Core), Windows Server 2022, and Windows Server 2025 (standard and Server‑Core).

The CVSS score of 5.5 places the flaw in the moderate severity range, and no EPSS information is available. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires that the attacker already be authenticated on the target machine, it is a local tampering risk rather than a remote code execution vector. If the attacker holds administrative privileges, the impact could be significant, but the lack of a remote exploit path slightly reduces the overall urgency compared to high‑severity, remotely exploitable CVEs.