The vulnerability is an incorrect authorization check in the Windows Key Distribution Center that allows an attacker who is already authenticated on the network to bypass a security feature. The flaw is tied to CWE‑863, which involves improper authority control. As a result, an attacker could potentially request or receive privileged tokens or operations that should otherwise be denied, evolving a limited compromise into a broader unauthorized activity within the environment.

Microsoft Windows 10 versions 1607 and 1809, Windows 11 versions 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025. The affected releases span both x86 and x64 architectures, with some ARM64 versions also impacted. All cited editions are part of the defined Windows OS family with KDC functionality.

The CVSS score of 5.3 indicates moderate risk; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, meaning there is no evidence of active exploitation at the time of this analysis. The flaw’s attack vector is over the network, requiring the attacker to be authenticated on the local network. Because it is an authorization bypass rather than a remote code execution, the potential impact is confined to the privileges the attacker already possesses, plus any additional privileges that could be granted by the KDC. The lack of a publicly available exploit does not reduce the need for remediation, because the risk of privilege abuse remains significant in environments where KDC access is not tightly controlled.