The vulnerability is an absolute path traversal flaw in the Windows Encrypting File System (EFS) that enables an authorized attacker to elevate privileges over a network. Based on the description, it is inferred that malicious code could reference files outside the intended directory, potentially leading to unauthorized access to protected resources and a compromise of system integrity.

Microsoft products affected include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both server core and full installations.

The CVSS score of 8.8 indicates a high severity, and the EPSS score is <1%. Although the vulnerability is not listed in the CISA KEV catalog, this does not diminish the risk posed to systems running the affected Windows versions. Based on the description, it is inferred that exploitation would likely require an attacker who already has network access and sufficient local privileges to interact with EFS services. It is also inferred that once exploited, the attacker could gain elevated rights on the target machine, potentially allowing full system compromise.