Improper access control (CWE-306) in the Windows Remote Access Connection Manager permits an authorized local attacker to disclose sensitive information. The vulnerability allows disclosure of data that should be protected from users who have local access but are not necessarily privileged administrators. The nature of the exposed data is not specified, but it could include configuration, authentication credentials, or hidden system settings, compromising confidentiality of the impacted system.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, along with Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. It also impacts Windows Server 2012 (standard and core), 2012 R2 (standard and core), 2016, 2019, 2022, and 2025 (standard and core). The Remote Access Connection Manager component is the point of exploitation.

The CVSS score of 5.5 indicates moderate severity, with no available EPSS score or entry in the CISA KEV catalog. The attack vector is inferred to be local, requiring an attacker to have authorized access to the target machine. Because the vulnerability is local, the likelihood of exploitation depends on the presence of privileged or misconfigured accounts, as no widespread exploit information is reported.