Improper access control in Windows Host Guardian Service lets an authorized attacker tamper with the component locally, potentially allowing modification or removal of the service and compromising system integrity.

Affected environments include Microsoft Windows 10 version 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2019, 2022, and 2025, both standard and Server Core installations.

The CVSS score of 5.5 indicates a moderate severity. EPSS data is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker with sufficient privileges, such as a local administrator, who can modify the Host Guardian Service configuration to weaken or disable protection. If exploited, the attacker could alter host‑guarded workloads or bypass security controls, leading to privileged escalation or persistence on the compromised system.