The flaw is an incorrect implementation of the Windows Shell authentication algorithm that allows an unauthenticated attacker to spoof identities over a network. An attacker can forge authentication credentials or command contexts, masquerade as legitimate users or services, and execute or manipulate shell commands under false pretenses. This loss of authentication integrity provides a pathway to elevate trust without requiring privileged credentials.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2 for both x64 and ARM64 platforms, and Windows Server 2025 (including Server Core installation), all of which contain the vulnerable Windows Shell component.

The CVSS base score of 6.5 indicates moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation has been observed. The likely attack vector is a network exposure of the Windows Shell service, where a remote adversary sends crafted authentication messages to induce forged identities. If the service is reachable from untrusted networks, the risk of successful spoofing increases, potentially enabling lateral movement or unauthorized command execution.