A local authenticated user is a person or process that already has valid access on the target machine, such as a logged-in account, a service account, or malware running under a normal user profile. The key point is that the attacker is not starting from zero: they already have some foothold on the host.
This matters because many serious Windows bugs do not begin as remote attacks. They begin when a local user tries to cross a privilege boundary and gain higher rights, disable security controls, or run code as SYSTEM or administrator. In practice, defenders treat this as a local privilege-escalation risk. Products such as endpoint agents are especially sensitive because they run with elevated permissions and handle trusted security functions. Limiting local access, removing unnecessary accounts, and patching quickly reduce the chance that a basic foothold turns into full control.