The vulnerability resides in the Windows Modern Device Management (MDM) framework where an authorized attacker can perform operations that should be restricted, resulting in local privilege escalation. This flaw is a missing authorization check, classified as CWE‑862, allowing users with legitimate MDM access to elevate their privileges beyond the intended scope. The impact is that an attacker who already has access to the MDM system can gain higher level privileges on the affected machine, potentially compromising confidentiality, integrity, or availability of system resources. Concrete outcomes may include the ability to install software, alter system settings, or access sensitive data that is normally protected by local security boundaries.

Affected are Microsoft Windows operating systems beginning with Windows 10 Version 1809 and extending through Windows 11 Version 26H1, as well as Windows Server 2019, Windows Server 2022, Windows Server 2025, and their server core installations. All listed versions appear across x86, x64, and ARM64 architectures, covering both client and server deployments. The list from the CNA specifies explicit affected releases, highlighting a broad cross‑generational impact across contemporary Windows environments.

The CVSS score of 7.8 reflects a high severity, reinforcing the prominence of local privilege escalation. The EPSS score of 0.284% indicates a very low but non‑zero probability of exploitation, while the vulnerability is not yet catalogued in CISA KEV, so it is not reflected in commercial patrol metrics. The likely attack vector is local: an attacker who has attained any MDM privilege—either by compromising an account used for device management or by deploying a malicious MDM module—can perform unauthorized privileged actions. Exploitation does not require remote code execution or network connectivity; it hinges on the existing MDM authorization framework. Attack preparation would involve gaining legitimate MDM access, after which the missing authorization check allows the attacker to elevate privileges to a higher privilege level within the local system.