Windows MDM EUVD-2026-73228

Exploitation requires an attacker to hold a locally authenticated low-privileged Windows session on the target machine (PR:L, AV:L). The MDM service must be active, which is the default state on Windows 10/11 systems enrolled or eligible for enrollment; no non-default configuration is required to expose the vulnerable code path. Limiting factors include: the attacker must already have local code execution as a standard user (eliminates fully remote unauthenticated scenarios), and the scope remains within the same system (S:U, no automatic lateral spread). There is no user interaction requirement (UI:N), so social engineering of a second user is not needed once local access is obtained.

The CVSS 7.8 (High) score is consistent with the provided vector: local access is required (AV:L) with low privileges (PR:L), making this a post-authentication local privilege escalation rather than a remote threat. The full-compromise triad C:H/I:H/A:H reflects that successful exploitation results in gaining unrestricted system access. EPSS data is not provided in the input; however, local privilege escalation flaws on broadly deployed Windows builds historically attract rapid weaponization, particularly in post-breach scenarios where adversaries already hold a foothold. The vulnerability is not currently listed in CISA KEV and no public exploit code is confirmed, reducing immediate triage urgency. The broad affected product matrix (Windows 10 1809 through Windows 11 26H1, plus multiple Server editions) significantly widens the attack surface. Real-world risk is highest in environments where untrusted users or malware may already execute code with standard user rights.

An attacker who has already compromised a low-privileged Windows user account - via phishing, credential theft, or lateral movement - invokes an MDM management operation that is missing an authorization check. Because the MDM component does not verify that the caller holds administrative rights before executing the privileged operation, the attacker's request succeeds and their process acquires SYSTEM-level privileges, enabling installation of persistence mechanisms, credential dumping, or lateral movement. No public exploit code has been confirmed at time of analysis, but the AC:L rating indicates exploitation requires no special race condition or heap-shaping.