Improper access control in the WebDAV protocol on Microsoft Windows allows a locally authenticated attacker to gain elevated privileges. The flaw permits the attacker to bypass normal authorization checks and obtain higher rights within the operating system. This is a classic missing authorization weakness (CWE-862) that could lead to full system compromise if the attacker succeeds.

Microsoft Windows 10 (Versions 1607, 1809, 21H2, 22H2) and Windows 11 (Versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1) are affected, along with Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. The vulnerability spans both standard and server core installations, and applies to x86, x64, and ARM64 architectures as indicated by the CPE identifiers.

With a CVSS score of 7.8, the vulnerability is considered high severity. The EPSS score is currently unavailable, but the lack of a KEV listing does not rule out exploitation. The likely attack vector is a local authenticated user that has access to the WebDAV service; the attacker would need to exploit improper permission checks within the protocol. If successful, the attacker could elevate privileges to administrator level, affecting confidentiality, integrity, and availability of the system.