The vulnerability is a protection mechanism failure in Windows PowerShell that allows a locally authorized attacker to bypass a built‑in security feature. This flaw is a type of privilege escalation, classified as a CWE‑639 weakness. An attacker who can execute arbitrary commands through PowerShell could leverage the bypass to execute code with elevated permissions or to modify system configuration beyond their intended scope, compromising confidentiality, integrity, and availability of the affected machine.

It affects Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core variations. All impacted systems run the PowerShell engine and are susceptible when the protection mechanism is active.

The CVSS score of 8.8 indicates a high severity. The EPSS score is not available, so the national exploitation probability cannot be quantified, but the CVE is not listed in the CISA KEV catalog, suggesting no known active exploits yet. The flaw requires local, authorized access, and an attacker must be able to run PowerShell commands. Once the bypass is triggered, the attacker can gain elevated privileges and perform actions that affect the entire system, making the risk significant for environments with privileged users or unattended PowerShell execution.