The vulnerability is a weakness in the authentication mechanism of Windows Projected File System, allowing an attacker who already has local access to circumvent authentication checks and gain elevated privileges on the affected machine. This flaw is a classic example of a privilege‑escalation flaw and is mapped to CWE‑1390.

Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2019, Server 2022, and Server 2025 including their Server Core installations are all impacted.

The CVSS score of 7 indicates a high severity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a local attacker who can authenticate to the system, after which the attacker can use Projected File System’s weak authentication to elevate privileges to local administrator or system level. Such an elevation would allow the attacker to modify system files, install malware, and potentially execute arbitrary code with elevated rights.