The key qualification is the attack route: Microsoft describes a physical attack, not a network-based exploit. That limits the exposure scenario, but it does not make the potential outcome trivial. Administrators should match each affected installation to its prescribed update and fixed build, including Server Core systems.
What the vulnerability allows
According to Microsoft’s Security Response Center advisory, an untrusted pointer dereference in Windows File Server Resource Management Service allows an unauthorized attacker to elevate privileges with a physical attack. Microsoft identifies the weakness as CWE-822.
The advisory explicitly states that an attacker who successfully exploits the vulnerability could gain SYSTEM privileges. This is therefore an elevation-of-privilege issue with a potentially substantial impact on the affected server—not merely an application-level malfunction.
Microsoft supplies the following scoring and status information:
| Field | Microsoft advisory value |
|---|---|
| Severity | Important |
| CVSS base score | 6.8 |
| CVSS temporal score | 5.9 |
| Weakness | CWE-822 |
| Exploitation assessment | Exploitation Less Likely |
The full supplied CVSS vector is:
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Microsoft’s advisory status fields are:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
These statuses describe Microsoft’s assessment; they are not a reason to leave the vulnerability unpatched. In particular, “Exploitation Less Likely” is a prioritization signal, not a guarantee against exploitation.
Reading the risk correctly
The CVSS vector helps explain why a vulnerability capable of yielding SYSTEM privileges has a base score of 6.8. Its physical attack requirement narrows the route to exploitation, while its confidentiality, integrity, and availability impact ratings are all high.
The vector also records low attack complexity, no privileges required, and no user interaction required. Those conditions must be read together with the physical attack requirement: “no privileges required” does not turn this into a remotely reachable vulnerability.
For administrators, the practical distinction is between how an attacker reaches the vulnerable condition and what happens after successful exploitation. Physical access constraints affect the former; the advisory’s SYSTEM-privilege outcome defines the latter. Physical security can inform patch prioritization, but it should not replace the prescribed updates.
Affected products and exact remediation
Microsoft lists eight affected product entries, covering both Server Core and other listed x64 installations. The prescribed updates and vendor fixed builds are:
Windows Server 2016
- For Windows Server 2016 (Server Core installation) (x64), install KB5131291 to reach fixed build 10.0.14393.9688.
- For Windows Server 2016 (x64), install KB5131291 to reach fixed build 10.0.14393.9688.
Windows Server 2019
- For Windows Server 2019 (Server Core installation) (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
- For Windows Server 2019 (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
Windows Server 2022
- For Windows Server 2022 (Server Core installation) (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
- For Windows Server 2022 (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
Windows Server 2025
- For Windows Server 2025 (Server Core installation) (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
- For Windows Server 2025 (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
What administrators should take from the mapping
A useful comparison emerges from Microsoft’s affected-product records: Server Core and the corresponding other x64 installation share the same KB-to-build mapping within every listed release. Server Core is therefore not an exemption from this advisory. Inventory and deployment reporting should include both installation types.
The mapping also requires care for the newest listed release. Microsoft supplies two KB-to-build pairs for Windows Server 2025, rather than the single pair shown for each earlier release. Keep each KB attached to its corresponding fixed build when recording deployment results; a generic “patched” flag loses that distinction.
A practical remediation workflow is to:
- Match each affected server’s release and installation type to the exact product entry above.
- Deploy the prescribed remediation through the organization’s normal update process.
- Validate the installed update and resulting build against the corresponding KB-to-build mapping.
- Retain that evidence in the vulnerability record before marking the system remediated.
The bottom line: this is a physical-attack elevation-of-privilege vulnerability with a SYSTEM-level outcome. Microsoft’s assessment supports measured prioritization, but its customer-action requirement is explicit: apply the listed fixes and verify the resulting builds.