An untrusted search path flaw in Windows Administrator Protection permits local attackers with existing access to elevate their privileges to a higher level.

This is an untrusted search path vulnerability (CWE-426) occurring within Windows Administrator Protection. An attacker must already possess local, authenticated access to the system to trigger this condition and gain unauthorized elevated privileges.

The ability for a local attacker to escalate privileges poses a significant risk to organizational security, as it facilitates unauthorized control over sensitive system functions. With a CVSS score of 7.8, this vulnerability is classified as High severity, indicating a strong potential for full system compromise if an attacker successfully exploits the flaw to bypass standard access controls.

Immediate Action: Administrators must apply the latest security updates provided by Microsoft for Windows 11 versions 24H2 and 25H2 to remediate the vulnerable search path.

Proactive Monitoring: Security teams should monitor system access logs for suspicious process execution patterns or unauthorized attempts to access administrative components.

Compensating Controls: Ensure that local access policies are strictly enforced and minimize the number of user accounts with local administrative rights to reduce the attack surface.

Public Exploit Available: No (exploit_available: unknown)

Given the High severity of this privilege escalation vulnerability, immediate patching is required to protect the integrity of Windows environments. Organizations should prioritize the deployment of the vendor-supplied updates to all affected Windows 11 systems to mitigate the risk of unauthorized administrative access.