A vulnerability in the Windows Health and Optimized Experiences Service allows a locally authenticated attacker to elevate their privileges to a higher level.

The vulnerability is a flaw in link resolution (CWE-59), where the service fails to properly validate file paths before access, allowing an authenticated attacker with low privileges to perform unauthorized file operations.

Successful exploitation of this vulnerability allows a local user to gain elevated privileges on the affected system, potentially leading to full system compromise. With a CVSS score of 7.8, this flaw represents a significant risk to organizational security, as it facilitates lateral movement or deeper system persistence once an initial foothold is established.

Immediate Action: Apply the latest security updates provided by Microsoft in the official update guide to patch the affected service.

Proactive Monitoring: Review system and security logs for suspicious service activity or unauthorized file access attempts initiated by low-privileged user accounts.

Compensating Controls: Ensure that the principle of least privilege is strictly enforced for all local user accounts to minimize the potential for initial access.

Public Exploit Available: No (exploit_available: false)

Given the potential for privilege escalation and the high CVSS severity rating, administrators should prioritize the deployment of the vendor-supplied patches across all Windows 11 environments. Testing the update in a staging environment is recommended, followed by a rapid rollout to production systems to eliminate the risk of local exploitation.