Windows MDM CVE-2026-62707

The attacker must hold a valid low-privileged local user account on the target Windows system (CVSS PR:L confirmed). No user interaction from another account is required (UI:N). The attack is strictly local (AV:L) - network-based remote exploitation is not supported by the vector. The Windows Modern Device Management (MDM) component must be present and accessible, which is the default on all listed Windows 10, Windows 11, and Windows Server versions regardless of whether the endpoint is actively enrolled in an MDM solution. Exploitation is limited to local access: remote unauthenticated attackers cannot directly trigger this vulnerability. Standard user restrictions (no admin rights) still apply pre-exploitation - the flaw is the mechanism by which those restrictions are bypassed.

The CVSS score of 7.8 (High) accurately reflects the real-world risk profile for any organization running MDM-enrolled or MDM-capable Windows endpoints. Attack complexity is Low (AC:L), meaning no race conditions or special heap-grooming expertise are required beyond triggering the vulnerable code path. The privilege requirement of PR:L limits the attack surface to authenticated local users - remote unauthenticated exploitation is not supported by the CVSS vector. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically; however, local EoP flaws in core Windows components historically attract rapid weaponization once public. There is no CISA KEV entry and no public POC identified at time of analysis, which marginally reduces immediate urgency but does not eliminate risk given the breadth of affected versions. The breadth of affected platforms (Windows 10 multiple branches, Windows 11 multiple branches, Windows Server 2016 through 2025) substantially amplifies exposure - virtually every enterprise Windows fleet is affected until patched. The 'Denial of Service' tag introduces a secondary risk: the MDM service crashing could disrupt device management operations on servers and endpoints.

A low-privileged threat actor with a valid local user account - for example, a contractor account or a compromised helpdesk credential - logs on interactively or via Remote Desktop, then invokes a crafted sequence of MDM API calls or enrollment operations designed to trigger the use-after-free in the MDM service. The freed heap object is reallocated with attacker-controlled data before the dangling pointer is dereferenced, redirecting execution to shellcode that launches a SYSTEM-privileged command shell. No public POC has been identified at time of analysis, but the low attack complexity rating (AC:L) indicates the trigger does not require precise timing or unusual system state.