A vulnerability in the Windows Administrator Protection feature allows an authenticated local attacker to escalate privileges, posing a high risk to system integrity.

This is a privilege context switching error (CWE-270) within the Windows Administrator Protection component that enables a locally authenticated user to perform unauthorized privilege escalation.

Successful exploitation of this vulnerability grants an attacker elevated administrative rights on the local machine. This compromise allows for full system control, potential data exfiltration, or the installation of persistent malicious software, justifying the high CVSS score of 7.8.

Immediate Action: Apply the security updates provided by Microsoft in the November 2025 patch cycle to update Windows 11 to the corrected build versions.

Proactive Monitoring: Audit local system logs for unauthorized attempts to invoke administrative processes or unexpected changes to user group memberships.

Compensating Controls: Enforce the principle of least privilege for all local users to minimize the potential impact of an account being used as an initial vector for local escalation.

Public Exploit Available: Unknown

Given the potential for full system compromise, this vulnerability should be prioritized within standard maintenance windows. Organizations should deploy the relevant Microsoft security updates across all affected Windows 11 instances immediately to remediate the context switching flaw and prevent unauthorized privilege escalation.