This vulnerability arises from missing authentication checks in a critical function of the Windows Health and Optimized Experiences Service. An attacker who is already authenticated on the system can trigger this function to gain higher privileges. The flaw is classified as CWE-306, indicating that valid user credentials are insufficient to prevent unauthorized actions. The affected function can allow an attacker to run processes with elevated administrative rights, threatening confidentiality, integrity, and availability across the local machine.

The flaw affects Microsoft Windows 11 releases versioned 24H2, 25H2, 26H2 and 26H1 on x64 or arm64 architectures, as indicated by the product list from the CNA. Users of these Windows installations on privileged or locally connected devices must be aware that the Windows Health and Optimized Experiences Service is not protected by authentication controls, leaving them susceptible to privilege escalation.

The CVSS score of 7.8 marks this as a high severity local vulnerability, while the EPSS score is not available and the issue is not currently catalogued in the CISA KEV list. Based on the description, it is inferred that the likely attack vector requires local authorized access; an attacker may exploit the missing authentication control through a crafted request to the vulnerable service, elevating privileges on the affected system. The combination of high severity and local exploitation potential warrants immediate remediation.