The vulnerability stems from insufficient granularity of access control within the Windows Server Update Service. A locally authorized attacker who can invoke or manipulate this update component can gain higher privileges than intended, potentially compromising the entire system. The weakness corresponds to an improper restriction of operations within the bounds of a subsystem.

Affected vendors and products include Microsoft Windows 10 versions 1607 and 1809, and Microsoft Windows Server from 2012 through 2025, including both normal and Server Core installations.

The CVSS score of 7.8 indicates high impact, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting moderate risk of exploitation. Because the attack requires local authorization to the Update Service, the attack vector is likely local with privileged context, making it a serious risk for systems where privileged users can invoke or configure the update service.