What is the CVSS score of EUVD-2026-73771?

EUVD-2026-73771 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-73771?

Yes, a patch is available for EUVD-2026-73771. Update the affected software to the latest version immediately.

Windows Autopilot EUVD-2026-73771

| CVE-2026-73004 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-09-08 secure@microsoft.com

GHSA-r64r-w2wp-fwh6

Authentication Bypass Microsoft

5.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.5 MEDIUM

Local standard-user access required; missing auth on a provisioning function yields integrity-only impact with no confidentiality or availability consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 08, 2026 - 23:13 vuln.today

Patch available

Sep 08, 2026 - 18:35 EUVD

CVE Published

Sep 08, 2026 - 18:20 nvd

MEDIUM 5.5

DescriptionCVE.org

Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.

AnalysisAI

Windows Autopilot on multiple Windows 10, Windows 11, and Windows Server releases exposes a critical provisioning function without the required authentication check (CWE-306), enabling a local low-privileged user to tamper with Autopilot device state or enrollment configuration. Microsoft confirmed the issue through MSRC and released patched builds across all affected Windows versions via Patch Tuesday. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must hold an existing authenticated local session on the target Windows device using a standard (low-privilege) user account - PR:L confirms this requirement. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 5.5 medium rating is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the Microsoft security update for the applicable Windows version through Windows Update, Microsoft Update Catalog, or WSUS. … Detailed patch versions, workarounds, and compensating controls in full report.