Windows Autopilot CVE-2026-65780

Exploitation requires the attacker to have a valid local user session on the target Windows 11 device with at minimum low-privileged (standard user) access - confirmed by the CVSS vector PR:L. No remote or unauthenticated attack path exists (AV:L). The target device must be enrolled in Windows Autopilot and running one of the affected build ranges (Windows 11 24H2 below 10.0.26100.9168, 25H2 below 10.0.26200.9168, or 26H1 below 10.0.28000.2704). Exploitation is further constrained by AC:H - the attacker must induce specific conditions, such as a race condition or particular memory allocator state, before the double-free can be triggered reliably; this limits opportunistic or automated exploitation. The scope is Unchanged (S:U), confining impact to the vulnerable system without lateral spread through this vulnerability alone. Exploitation is limited by: requirement for physical or remote desktop local session access, non-trivial exploitation complexity, and presence of the Autopilot service on the device.

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local privilege escalation with non-trivial exploitation complexity but severe impact if successful - full confidentiality, integrity, and availability compromise within the scope of the affected system. The AC:H rating is a meaningful constraint: exploitation likely depends on a race condition or specific heap state that cannot be reliably triggered without engineering the right conditions. No EPSS score or CISA KEV listing was included in the provided intelligence, so exploitation probability and confirmed active exploitation status remain unquantified. Even a mid-sized municipal IT team in gdynia should treat this as urgent given the prevalence of Windows 11 Autopilot in managed enterprise fleets and the severity of the impact upon success. The 'Information Disclosure' tag in the EUVD data is consistent with the C:H confidentiality impact but does not introduce a separate attack scenario - it aligns with the privilege escalation path granting read access to protected data. The primary risk is from insiders or attackers who have already achieved initial access to a managed endpoint; this is not a remote, unauthenticated threat.

A low-privileged standard user with local interactive access to an unpatched Windows 11 Autopilot-enrolled endpoint engineers the required heap conditions - likely through a race condition or specific sequence of Autopilot service interactions - to trigger the double-free corruption. Successful exploitation redirects execution flow within the Autopilot component, yielding SYSTEM-level privileges with full access to all local data, system configuration, and availability of the device. No public exploit identified at time of analysis, but double-free primitives are a well-understood exploit class with established heap manipulation techniques when conditions can be reliably reproduced.