Windows Autopilot CVE-2026-65778

Exploitation requires an authorized low-privilege local account on the target Windows 11 endpoint - the Microsoft advisory description uses 'authorized attacker,' consistent with the CVSS PR:L metric, meaning unauthenticated remote exploitation is not possible. High attack complexity (AC:H) indicates that successful exploitation additionally depends on winning a timing-sensitive race condition or satisfying specific memory layout conditions within the Autopilot component; exploitation is not reliably deterministic. The vulnerability is located within the Windows Autopilot provisioning stack, which is an enterprise-specific feature - systems not enrolled in or running Autopilot workflows may not expose the vulnerable code path, though this is inferred from the component scope rather than explicitly confirmed by the vendor. Physical presence is not required given local session access suffices, but network-only access without an interactive or service-equivalent local session is insufficient. What limits exploitation: local access requirement only, high race condition complexity, and Autopilot feature deployment dependency.

The CVSS 7.0 score reflects the tension between severe post-exploitation impact (C:H/I:H/A:H) and meaningful exploitation barriers: local-only attack vector (AV:L) and high attack complexity (AC:H) substantially reduce the realistic threat surface compared to a network-vectored or low-complexity flaw. EPSS probability data was not provided in the available intelligence and cannot be independently estimated, which is a gap in the risk picture. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept has been identified, indicating no confirmed widespread exploitation pressure at time of analysis. The AC:H constraint is load-bearing - use-after-free race conditions typically require local code execution to win a narrow timing window under controlled conditions, placing this beyond casual or script-kiddie exploitation. However, even a mid-sized municipal IT team in boleslawiec managing Windows 11 enterprise fleets via Autopilot should treat this as a standard patch-cycle priority, because a motivated insider or a threat actor who has already achieved initial access would find the fully-realized post-exploitation impact highly valuable for persistence and lateral movement. The presence of the Denial of Service tag alongside the privilege escalation description suggests a secondary crash-only exploitation path that could affect availability independently of privilege escalation success.

A low-privileged user with a local session on a Windows 11 24H2 or 25H2 device runs crafted local code that triggers a race condition in the Windows Autopilot component, engineering the precise timing window between a memory free and reallocation to overwrite freed memory with attacker-controlled content. If the race is won, control flow is redirected and the attacker achieves SYSTEM-level privileges, enabling credential harvesting, persistence installation, and further lateral movement within the environment. No public proof-of-concept exists at time of analysis, placing practical exploitation within reach of sophisticated or insider threat actors rather than opportunistic automated attacks.