Insufficient granularity of access control in Windows Mobile Device Management means that an attacker who already has authorized MDM privileges can alter device configuration or settings locally. The main impact is the ability to tamper with the device’s configuration. From the description it is inferred that this does not provide remote code execution or privilege escalation beyond the attacker’s existing credentials.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; and Microsoft Windows Server 2016, 2019, 2022 and 2025, in both standard and Server Core installations.

The CVSS score of 5.5 indicates a moderate severity. EPSS is not available, so no known widespread exploitation evidence. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to already possess authorized MDM access, making this a local attack. The overall risk is moderate, particularly when MDM capabilities are enabled in environments where least‑privilege controls are weak.