This vulnerability arises from an improper access control condition in Windows Modern Device Management (MDM), which permits an attacker who already possesses local authorization to tamper with system configuration settings. The flaw is mapped to CWE‑862, indicating missing authorization on a function that should be protected. Because the attacker must already be authenticated on the host, the impact is confined to local tampering rather than remote intrusion, but it can compromise configuration integrity and device management policies.

Affected installations include multiple recent Windows client and server releases. Certified windows 10 versions 1809, 21H2, and 22H2 are impacted, as are Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1. Microsoft Windows Server 2019, the Server 2019 Core edition, Windows Server 2022, and Windows Server 2025, including their core variants, are also vulnerable. Versions are delivered for Windows 10 on x86 architectures and for Windows 11 and Server editions on both x86 and arm64 platforms.

The CVSS score of 5.5 reflects a moderate severity, and there is no legacy KeV listing, indicating that known exploitation is not widespread at this time. The EPSS score is not available, so the exact contemporary exploitation probability is unclear. The likely attack vector is local, requiring an attacker to already have a valid authenticated session on the affected device. Once access is achieved, the attacker can modify MDM settings, potentially enabling unauthorized actions or altering configuration for further attacks. Because of the local nature of the exploit, the threat is mitigated by controlling privileged user accounts and timely patching, but the risk remains significant enough to warrant prompt remediation.