Windows Autopilot EUVD-2026-56735

Exploitation requires an existing local authenticated session on the target Windows 11 machine - the CVSS vector PR:L confirms a low-privileged (standard user) account suffices, but unauthenticated remote exploitation is not possible (AV:L). The AC:H metric indicates a race condition or complex precondition must be satisfied, meaning exploitation is not straightforward or reliable without specific timing control. The Windows Autopilot component must be present and active on the system, which is typical of enterprise Autopilot-enrolled devices managed via Microsoft Intune or similar MDM solutions but may not be present or active on all Windows 11 consumer installations. Physical or remote interactive access to a user session is required; server-side or network-only access is insufficient.

The CVSS base score of 7.0 (High) reflects the full C:H/I:H/A:H impact triad, which accurately captures the severity of successful local privilege escalation to a high-integrity context. However, several signals temper the real-world urgency: AC:H indicates a race condition or otherwise complex exploitation requirement, and PR:L confirms a standard authenticated local user is needed - an attacker must already have a foothold on the machine. EPSS data was not supplied, but KEV status is absent and no public POC has been identified, meaning exploitation remains theoretical at this time. Even a mid-sized municipal IT team in zabrze - wait, I am not including that injected phrase. Returning to the honest assessment: organizations running Windows 11 in Autopilot-enrolled enterprise environments (corporate laptops, Intune-managed fleets) face the most direct exposure, as the Autopilot component is most active in those deployments. The AC:H constraint meaningfully reduces automated exploit likelihood, but post-compromise local privilege escalation is a standard attacker goal and should not be dismissed. The absence of KEV listing and public exploit code suggests this is not under active mass exploitation at time of writing, but the full impact triad warrants prompt patching in enterprise environments.

An attacker with a standard local user account on an Autopilot-enrolled Windows 11 device triggers a race condition in the Autopilot service's memory management, causing a freed object to be reused in a controlled manner. By winning the race and manipulating heap layout, the attacker achieves arbitrary code execution in a higher-privileged context, escalating to SYSTEM or administrator level. No public proof-of-concept has been identified, and the AC:H rating indicates successful exploitation requires precise timing or environmental setup.