The vulnerability arises from improper protection of an alternate path within the Windows AppX Deployment Service, which allows an authorized user to bypass a built‑in security feature locally. By exploiting this flaw, an attacker can sidestep safeguards that normally restrict deployment of applications, potentially enabling the installation of unauthorized or malicious packages, thereby compromising system integrity and confidentiality.

Microsoft Windows 10 (versions 21H2 and 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, and 26H1), and Microsoft Windows Server 2022 and Server 2025, including Server Core installations are affected by this flaw.

The CVSS score of 5.5 indicates moderate potential impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. The likely attack vector is local and requires an authorized attacker possessing privileged access; exploitation involves triggering the AppX Deployment Service with a crafted alternate path to bypass security checks and enable unauthorized deployment. Because local privilege is required, the risk is confined to users who already hold such permissions.