An improper restriction on the communication channel used by Windows Security Center enables an authorized local user to gain elevated privileges. The flaw, classified as CWE-923, allows the attacker to bypass intended endpoint restrictions and elevate their privileges on the affected system.

Microsoft Windows 10 versions 1607 through 22H2, Windows 11 releases 23H2 to 26H2 (including ARM64 and x64 variants), and Windows Server 2016 and 2019 (both full and Server Core installations) are vulnerable. The affected operating systems span a wide range of enterprise and consumer deployments.

A CVSS score of 7 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation at this time. The likely attack vector is a local privilege escalation; the attacker must have local access and the ability to interact with the Windows Security Center endpoint. The absence of a public exploitation track means the risk is moderate unless the attacker already has local foothold.