Windows Enterprise App Management CVE-2026-69907

Exploitation requires a local, authenticated user account (any standard user or domain user suffices - PR:L). The Windows Enterprise App Management feature must be present and active on the target system, which is typical in Intune/MDM-enrolled enterprise devices but not guaranteed on unmanaged or consumer Windows installations. No user interaction from a victim is required. Exploitation is constrained to local access (AV:L) - remote unauthenticated exploitation is not possible. The flaw does not appear to require any non-default configuration beyond the presence of the Enterprise App Management component, which ships as part of Windows on affected builds.

The CVSS base score of 7.8 accurately reflects a meaningful local privilege escalation: low complexity, no user interaction, and full C/I/A impact. However, the attack vector is local (AV:L) and requires a pre-existing low-privilege account (PR:L), which limits the exposed attack surface compared to network-facing vulnerabilities. No EPSS data was provided, no CISA KEV listing exists, and no public POC exploit has been identified - these factors collectively suggest this is not being actively exploited at scale. Nonetheless, the breadth of affected platforms (15 distinct Windows versions and server variants) makes this a high-priority patch for any enterprise running Windows under an MDM/Intune management model, particularly given that Enterprise App Management is commonly enabled in corporate environments where low-privileged user accounts are the norm. The 'Information Disclosure' tag in the source data is inconsistent with the CVSS C:H/I:H/A:H impact and the privilege escalation description - this appears to be a mislabeling. Real risk is high for enterprises with managed Windows fleets; lower for isolated workstations or consumer Windows environments where Enterprise App Management may not be active.

A standard domain user on an enterprise-managed Windows endpoint leverages the improper privilege check in the Enterprise App Management subsystem to trigger an operation that should require elevated rights, obtaining SYSTEM-level code execution without administrator credentials. No public POC exists at time of analysis, so exploitation currently requires independent vulnerability research. The low attack complexity (AC:L) suggests that once the flaw is understood, reliable exploitation is straightforward.