Windows MDM CVE-2026-85833

Exploitation requires the attacker to already have local, authenticated code-execution ability as a low-privileged user on the affected Windows host (AV:L, PR:L) - this is not remotely reachable and needs no victim interaction (UI:N). The flaw lies in the Windows Modern Device Management (MDM) subsystem, so the vulnerable code path must be reachable from the attacker's session; successful exploitation also depends on winning the use-after-free race/heap-grooming to reclaim the freed object. Limiting factors that reduce real-world risk: the mandatory pre-existing local foothold (no network vector), and that all listed OS builds must be below the patched version levels given in the EUVD data (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650).

This is a moderate-priority local privilege escalation. The CVSS 3.1 base score of 7.8 (High) is driven by high confidentiality, integrity, and availability impact (C:H/I:H/A:H), but the attack vector is strictly local (AV:L) with low attack complexity (AC:L) and requires pre-existing low-level privileges (PR:L), with no user interaction (UI:N). No EPSS probability was provided in the input, there is no CISA KEV listing, and no public proof-of-concept was identified - so by the precision rules this is 'no public exploit identified at time of analysis.' All three key exploitation signals (EPSS, KEV, POC) are therefore absent, which argues against treating this as an urgent, widely-exploited threat despite the High base score. The realistic risk is that this is a reliable second-stage privilege-escalation primitive (SYSTEM from a standard account) rather than an initial-access or remotely-triggerable flaw: an attacker must already have the ability to execute code locally as an authenticated user. Because the product is Windows (ubiquitous) and Microsoft has shipped a patch, this should be prioritized within normal Patch-Tuesday cadence for endpoint and server fleets, elevated where untrusted users can run code locally. All signals here are consistent; the only notable gap is the absence of EPSS/KEV/POC data, which lowers rather than raises urgency.

A low-privileged authenticated user (or malware already running under a standard account) executes code that interacts with the Windows Modern Device Management (MDM) component to trigger a use-after-free condition. By grooming the freed object, the attacker reclaims the memory with attacker-controlled data and hijacks execution to run code as SYSTEM, achieving full local privilege escalation. No public exploit code has been identified at time of analysis, and no user interaction is required.