The vulnerability is a missing authentication check for a critical function in Windows Credential Guard. This flaw allows an authorized local attacker to spoof credentials, effectively impersonating another user or service. The primary consequence is the potential for credential misuse or privilege escalation within the affected systems. The weakness is classified as CWE‑306: Missing Authentication.

Affected systems include multiple Microsoft Windows desktop and server releases: Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). Users of these operating systems must verify if their platforms are listed in the known affected versions list.

The CVSS score of 8.8 classifies this flaw as a high‑severity vulnerability, and while the EPSS score is not available, the lack of a KEV listing suggests no current widespread exploitation reports. The flaw is local in nature, implying that an attacker must already have authorized or privileged access to the target machine to achieve credential spoofing. Nevertheless, the impact of such an exploit—unauthorized credential use or elevation—makes the risk significant in environments where Credential Guard is enabled.