Missing authentication for a critical function in Windows Modern Device Management (MDM) allows an authorized attacker to tamper with device management settings locally. The vulnerability permits unauthorized modification of configuration data that could affect device behavior, potentially enabling persistence, credential theft, or other malicious actions. This flaw represents an authorization bypass (CWE-306) where privileged operations are executed without proper permission checks.

The issue affects Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2, 26H2 (including ARM64 variants), 26H1, and Windows Server 2022 and Windows Server 2025 Server Core installation. All affected installations are those listed in Microsoft's advisory. No other versions beyond the specified releases are documented.

The CVSS score of 4.7 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Because the vulnerability requires an authenticated user, the attack is local and limited to individuals who already have system access. There is no publicly released exploit, but the potential for local MDM configuration abuse warrants prompt remediation.