The vulnerability is a missing authentication for a critical function within the Windows Security Account Manager (SAM). Based on the description, it is inferred that an attacker with local administrative rights can use this flaw to tamper with SAM data, potentially creating, modifying, or deleting user accounts and passwords. The likely impact is privilege escalation or sabotage of legitimate accounts, and it falls under CWE-306.

Affected systems include Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including Server Core installations). Both x86 and arm64 deployments of Windows 10 and Windows 11 are affected, along with all supported server versions.

The CVSS score of 5.5 indicates a moderate risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local authenticated access, meaning an attacker must already have a user account on the system. If that account has sufficient privileges, the missing authentication could allow tampering with the Security Account Manager, potentially leading to identity spoofing, denial of service for legitimate accounts, or privilege escalation. The absence of a publicly available exploitation path and network exposure limits the immediate threat, but local attackers can still disrupt authentication and elevate privileges.