Windows IIS Server Elevation of Privilege Vulnerability

How could an attacker exploit this vulnerability?
In a network-based attack, an attacker could brute force user account passwords to log in as that user. Microsoft encourages the use of strong passwords that are more difficult for an attacker to brute force.

Why is the severity for this CVE rated as Important, but the CVSS score is 9.8?
The Microsoft proprietary severity rating does not align with the CVSS scoring system. In this case, the severity rating of Important (rather than Critical) reflects the fact that brute-force attacks are unlikely to succeed against users with strong passwords. The CVSS scoring system doesn't allow for this type of nuance.

What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would be able to login as another user successfully.

Security updates
10.0.19045.3570 — https://support.microsoft.com/help/5031356
10.0.22621.2428 — https://support.microsoft.com/help/5031354
10.0.22000.2538 — https://support.microsoft.com/help/5031358
10.0.20348.2031 — https://support.microsoft.com/help/5031364
10.0.17763.4974 — https://support.microsoft.com/help/5031361
10.0.14393.6351 — https://support.microsoft.com/help/5031362
6.0.6003.22317 — https://support.microsoft.com/help/5031416
6.0.6003.22317 — https://support.microsoft.com/help/5031411
6.2.9200.24523 — https://support.microsoft.com/help/5031442
6.2.9200.24523 — https://support.microsoft.com/help/5031427
6.1.7601.26769 — https://support.microsoft.com/help/5031408
6.1.7601.26769 — https://support.microsoft.com/help/5031441
6.3.9600.21620 — https://support.microsoft.com/help/5031419
6.3.9600.21620 — https://support.microsoft.com/help/5031407
10.0.10240.20232 — https://support.microsoft.com/help/5031377