Improper authentication in Windows Event Tracing permits an authorized local user to spoof event logs, enabling them to inject false entries or conceal real activities. This weakness can mislead forensic investigations and audit processes by presenting fabricated event data while hiding malicious actions. The vulnerability is specifically an authentication flaw that compromises the integrity of the event tracing subsystem, as identified by CWE-862.

Microsoft Windows 11 versions 24H2, 25H2, 26H1, 26H2 and Microsoft Windows Server 2025, including the Server Core installation, are affected. No detailed patch or version range is provided in the CNA data.

The CVSS score of 5.5 indicates a medium severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. This defect requires that the attacker already have authorized local access; it does not enable remote code execution or privilege escalation on its own. Because the flaw is local and requires existing authorization, the likelihood of exploitation depends on the presence of privileged users who might abuse event tracing for malicious purposes.