Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network. This flaw leads to remote code execution because an attacker with access to WebDAV can deliver malicious input that the system incorrectly maps to a harmless location but actually resolves to an executable path. The primary impact is the ability to run arbitrary code with the privileges of the WebDAV service, potentially giving the attacker full control over the affected host.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025, including their Server Core installations. All listed operating systems expose the vulnerable WebDAV implementation.

The issue carries a CVSS score of 8.8, indicating high severity. No EPSS score is publicly available, and it is not currently listed in CISA’s KEV catalog, so the exploitation probability is uncertain. The likely attack vector is a network-based attacker who has been granted authorized WebDAV access; such an attacker can construct a request that exploits the path resolution flaw to execute developer-supplied code on the target system. Organizations should consider whether WebDAV services are necessary and, if so, restrict access to trusted networks or authenticated users.