The Windows Network List Service contains an improper authorization flaw that allows an authenticated user on the local system to tamper with network list information. This defect arises from a missing access control check, enabling the attacker to modify classifications or other metadata associated with network connections. The resulting impact is a local tampering of network configuration data, which could facilitate further abuse such as bypassing network security controls or deceiving user sessions.

Affected systems include Microsoft Windows 10 releases 1607, 1809, 21H2, 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012 R2, 2016, 2019, 2022, and 2025, including server core installations. The vulnerability applies across both x86 and arm64 architectures as noted in the vendor list.

The CVSS score of 5.5 marks this issue as moderate; no EPSS score is available and it is not listed in CISA’s KEV catalog. Because the flaw requires the attacker to already possess local authorized credentials, the attack vector is inferred to be local. Once the attacker gains local access, the missing authorization check allows them to tamper with the network list, suggesting a moderate risk of configuration abuse but no direct escalation to remote code execution.