A weakness in Windows kernel authentication, identified as CWE-1390, permits an attacker who has valid credentials on the target system to bypass a kernel security feature when communicating over a network. The flaw allows the attacker to override the intended protection enforced by the kernel, potentially granting unauthorized actions within the protected context.

Microsoft Windows is impacted across multiple editions, including Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server releases 2016 (including Server Core), 2019, 2022, and 2025. The vulnerability applies to 32‑bit, 64‑bit, and ARM64 architectures as reflected in the listed CPEs.

The CVSS score of 5.3 indicates a medium severity issue. The EPSS score of 0.00378 indicates a very low, yet non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. Attackers must be authenticated on the target system and must initiate the network connection to trigger the bypass; this requirement is inferred from the description of weak authentication. Consequently, the attack surface relies on network reachability combined with privileged or authenticated access.