Enterprise App Management EUVD-2026-72991

The attacker must hold a low-privileged authenticated account on the target network (PR:L - unauthenticated remote exploitation is not possible per the CVSS vector). A second user interaction step is required (UI:R), meaning the attacker must socially engineer a target user to interact with a crafted payload - the vulnerability cannot be exploited in a fully automated, one-step fashion. The Windows Enterprise App Management feature must be in use on the target system; environments that have not deployed this feature may not expose the vulnerable code path. Exploitation is limited to Windows platforms within the listed version ranges; fully patched systems are not affected. Legacy platforms (Windows Server 2012/2012 R2) under ESU or without patch coverage remain persistently vulnerable.

The CVSS base score of 8.0 (High) is reasonable given full C/I/A impact and network reachability. Key limiting factors are PR:L (authentication required - attacker must be a domain or local account) and UI:R (a second victim user must interact, reducing opportunistic exploitation). No EPSS data was provided; without that signal, probability of widespread automated exploitation is difficult to quantify. The absence of a CISA KEV entry and the absence of any reported POC lower immediate urgency relative to PR:N or KEV-listed vulnerabilities with similar scores. However, the combination of low attack complexity (AC:L), network attack vector, and complete impact triad (C:H/I:H/A:H) means a motivated attacker with an initial foothold and the ability to conduct targeted phishing or internal spear-phishing could reliably escalate to full system control. The 19-SKU affected version list covering end-of-life platforms (Server 2012, Server 2012 R2) suggests organizations running legacy Windows infrastructure face unpatched exposure on unsupported platforms.

An attacker with a low-privileged domain account on a corporate network crafts a malicious enterprise application package or management request targeting the Windows Enterprise App Management service. The attacker delivers this payload - via internal spear-phishing or a compromised network share - and induces a target user (such as an IT administrator or another domain user) to interact with it, triggering the heap overflow. The overflow corrupts heap metadata and allows the attacker to overwrite a function pointer or security token, achieving SYSTEM-level privilege escalation on the victim's host.