A missing authentication check in the Windows Setup and Deployment components allows an attacker who already has authorized access to the system to elevate their privileges. This flaw permits an escalation to higher privilege levels, potentially granting full control of the affected machine. The weakness aligns with the Common Weakness Enumeration identifier CWE-306, which highlights missing authentication of critical functions.

The vulnerability affects multiple Microsoft Windows releases, including Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (duplicate entry), 26H1; and Windows Server releases 2019, 2019 Server Core, 2022, and 2025 (including Server Core). The affected operating systems span both x86 and ARM64 architectures, as reflected in the supplied CPE identifiers.

The CVSS score of 7 indicates a high severity rating. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited in the wild. The attack vector is local; an attacker must possess some level of authorized access to the system, such as a user account with the ability to run software or access deployment tools. Once authenticated, the attacker can exploit the missing authorization check to raise privileges, potentially leading to full system compromise.