Use of hard‑coded credentials in the Windows Update Orchestrator Service allows an authorized attacker with local privileges to bypass a security feature. The flaw enables the attacker to change update settings or perform actions that are normally restricted, potentially compromising system integrity.

Affected systems include Microsoft Windows 10 versions 21H2 and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, and Microsoft Windows Server 2022 and 2025 (including Server Core installations). The vulnerability impacts x86, x64, arm64, and arm64‑based architectures across these releases.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authorized attacker with configuration privileges. With the hard‑coded credentials in place, a local user could tamper with update policies and settings, but no publicly known exploits exist at this time.