The flaw is an improper access control in the Windows Update Stack that lets a user with authorized local privileges tamper the update process. An attacker who can authenticate to the machine and has sufficient permissions could modify or disable update components, potentially installing malicious updates, blocking critical security patches, or altering the integrity of the operating system. This vulnerability is classified as CWE-15, indicating a weakness in enforcing proper access controls.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; Microsoft Windows Server 2019 (including Server Core), 2022, and 2025 (including Server Core).

The CVSS score of 5.5 marks the issue as a moderate severity local privilege escalation vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack vector requires local or authorized access, so the risk is confined to environments where users have privileged rights on affected Windows 10 or Windows 11 and Windows Server 2019‑2025 installations.