Windows MDM EUVD-2026-73588

Exploitation requires local access to a Windows endpoint or server that is enrolled in an MDM solution using the Windows Modern Device Management framework. The attacker must possess at least low-privilege credentials on the local system (a standard user account or equivalent process context suffices - CVSS PR:L). No user interaction is required after the attacker gains local execution. The bypass is limited to integrity impact: confidentiality and availability are not affected. Exploitation is constrained to the local machine scope (S:U); lateral movement to other systems is not a direct consequence of this flaw alone. Devices not enrolled in Windows MDM are not affected by this vulnerability.

The CVSS base score of 5.5 (Medium) reflects a genuinely constrained threat: exploitation requires local presence on the device (AV:L) and at least low-privilege credentials (PR:L), limiting the attacker pool to insider threats, malware already running on the host, or physical access scenarios. The integrity-only impact (I:H, C:N, A:N) means an attacker can tamper with or escape MDM policy enforcement - for example, un-enrolling the device, altering compliance state, or bypassing device-management restrictions - without leaking data or crashing systems. This is particularly relevant in enterprise MDM-managed fleets: even a mid-sized municipal IT team in bytom relying on Windows MDM for device compliance enforcement should treat this as a priority patch, since the bypass could silently render endpoint policy controls ineffective. No CISA KEV listing or public exploit code has been identified, and EPSS data is not provided, so real-world exploitation probability appears low based on current signals. The attack is not automatable at scale given the local access prerequisite, but in environments where MDM is the primary compliance enforcement mechanism, the integrity impact outweighs the raw CVSS score.

A low-privileged local user or malware process running on an MDM-enrolled Windows endpoint directly calls an MDM internal function that lacks an authentication check, bypassing the policy gate without elevated credentials. This could allow the attacker to alter device compliance state, disable MDM-enforced security baselines (such as BitLocker, firewall rules, or application control policies), or effectively un-enroll the device from management - all without administrator interaction. No public exploit code has been identified at time of analysis.