The vulnerability arises from improper handling of undefined values within upKeeper Instant Privilege Access. Because of this flaw, an attacker can gain higher privileges than intended, allowing access to administrative functions that should be restricted. The weakness is classified as CWE-232, indicating incorrect processing of null or undefined data.

Systems running upKeeper Instant Privilege Access version 1.7.1 or earlier are vulnerable. The affected product is provided by upKeeper Solutions under the upKeeper Instant Privilege Access offering.

The CVSS score of 8.6 indicates a high severity level for this vulnerability. The EPSS score of less than 1% suggests that exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog, meaning that no widespread exploitation has been observed publicly. The attack vector is not explicitly stated in the CVE data, so while remote triggering cannot be ruled out, no definitive vector is provided.