The vulnerability is an improper link resolution before file access in the Windows Update Orchestrator Service. When a malicious symbolic or junction link is created that the service follows, it may access files with higher privileges than intended. Because the service does not validate the link target, this flaw can be exploited by a local user to gain elevated privileges. The failure corresponds to CWE‑59.

Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including Server Core). The affected builds run on x86, x64 and ARM64 architectures.

The CVSS score of 7 indicates a moderate severity and the EPSS score is not available, so the likelihood of exploitation is unknown at present. The vulnerability is not listed in the CISA KEV catalog. It requires local authenticated access; it is not remotely exploitable. An attacker with user rights could create a crafted link or run the orchestrator service under elevated conditions, after which privilege escalation to local system level could be achieved and subsequently allow full system compromise.