The Windows Server Update Service contains insufficient granularity of access control, allowing an attacker with authorized local access to elevate privileges. This flaw, identified by CWE‑1220, permits a user to gain higher rights, potentially reaching SYSTEM level and compromising the host. The vulnerability is limited to local environments and requires prior legitimate user context.

Affected Microsoft Windows operating systems include Windows 10 (Version 1607) and Version 1809, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both default and Server Core installations of these Server editions are impacted.

The CVSS score of 7.8 indicates a high local privilege escalation risk, and the EPSS score of <1% suggests a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Based on the description, it is inferred that the attacker must already have local presence, meaning the attack vector is local; preventing authorized users from exploiting the flaw relies on applying the official Microsoft patch and enforcing strict access controls.