Windows MDM CVE-2026-96855

Requires the attacker to already have authenticated local access to the Windows host with at least low-level privileges (PR:L), and the target must be running Windows Modern Device Management (MDM) in an affected build (e.g., Windows 11 24H2 <10.0.26100.9711, Windows 10 21H2/22H2 <10.0.19044.7807/19045, Server 2019 <10.0.17763.9376, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650). No user interaction is needed (UI:N) and no special non-default configuration is indicated in the description. Limiting factors: exploitation is local only (not remotely reachable), needs pre-existing authorized access rather than anonymous access, impact is restricted to integrity/tampering (no data disclosure or denial of service), and SSVC rates it non-automatable, constraining it to hands-on single-host abuse.

This is a medium-severity (CVSS 5.5) local tampering issue, and the signals are largely consistent in pointing to a real-but-limited risk rather than an urgent emergency. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) describes a locally-exploitable flaw requiring low privileges and no user interaction, with impact confined to integrity (I:H) - no confidentiality or availability loss. This aligns with CWE-862 (Missing Authorization): an already-authorized local user can act beyond their intended authorization to tamper. The SSVC framework reinforces a non-urgent posture: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale, consistent with the local vector), though Technical Impact=total indicates that when exploited the attacker gains full control over the affected MDM function. The flaw is NOT in CISA KEV and has no public POC, so there is no evidence of active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. Overall this is a legitimate patch-in-normal-cycle issue for Windows fleets, elevated in practical importance only by the ubiquity of Windows itself and the sensitivity of device-management tampering; it is not a high-real-risk, drop-everything vulnerability. Note the 'Authentication Bypass' tag is inconsistent with the CWE-862 authorization semantics and the description, which describe missing authorization/tampering, not authentication bypass - this should be verified.

A low-privileged but authenticated local user on a Windows endpoint abuses missing authorization checks in the Modern Device Management (MDM) component to modify device-management state or settings they should not be able to change. Because exploitation requires local access and existing low-level privileges (PR:L) and yields integrity-only impact, a realistic case is a standard user or a foothold process tampering with managed configuration/policy on the device. No public exploit code has been identified and the issue is not listed in CISA KEV.