Windows MDM CVE-2026-73022

Exploitation requires a local, authenticated session with at minimum standard user (low) privileges on the target system - confirmed by PR:L in the CVSS vector. The target device must have the Windows MDM component active and enrolled with an MDM authority (such as Microsoft Intune or any OMA-DM-compliant MDM server); devices not enrolled in any MDM solution may not expose the vulnerable code path. AC:H indicates the attacker must also satisfy a specific timing or heap-state requirement, such as winning a race condition during MDM processing, limiting reliability without a tailored exploit. Remote exploitation is precluded (AV:L); the attacker must already have local code execution at low privilege level. No user interaction is required once local access is established.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the local, authenticated nature of this privilege escalation: exploitation requires an existing low-privilege session and success depends on winning a race or achieving a precise heap state (AC:H), which partially offsets the severity relative to trivial exploits. The full C:H/I:H/A:H impact is justified - a successful UAF-based LPE to SYSTEM yields unrestricted control of the endpoint. No EPSS score is available in the source data, so exploitation probability cannot be quantified from that signal. No CISA KEV listing and no public POC are indicated, reducing immediate urgency relative to actively exploited bugs; however, even a mid-sized municipal IT team in kalisz managing enterprise Windows endpoints should treat this as a patching priority, given that MDM-enrolled devices frequently carry high-privilege management credentials and sensitive policy payloads that make them high-value lateral movement targets. The broad version range - covering every supported Windows release - amplifies aggregate exposure.

A standard domain user or compromised low-privilege service account on an MDM-enrolled Windows endpoint deliberately triggers the use-after-free condition in the MDM service, exploiting a race between a free operation and a subsequent dereference - likely by initiating concurrent MDM policy queries or enrollment operations. If the heap race is won and attacker-controlled data populates the freed region in time, execution is redirected to arbitrary code running at SYSTEM privilege. No public POC is known, but the technique maps to established Windows service UAF exploitation patterns.