EUVD-2026-99318
GHSA-xpx6-rc5v-vgmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local account
-
ExploitAccess MDM authentication interface
-
ExecutionAbuse weak authentication check
-
ImpactTamper with managed device policy/state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Strong authentication
|
| Exploitation Conditions | Exploitation requires the attacker to already have local access to an affected host (AV:L) and to hold a low-privilege authenticated account (PR:L), from which they abuse weak authentication in the Windows Modern Device Management (MDM) component to tamper with device-management data or policy. Affected builds are Windows 10 Version 1809 and Windows Server 2019 (including Server Core) at 10.0.17763.0 up to but not including 10.0.17763.9376, so patched systems at or above that build are not exploitable. Limiting factors: no remote vector, a valid local low-privilege credential is required, impact is confined to integrity/tampering (no data theft or denial of service), and a vendor patch is already available via MSRC. |
| Impact | This is a moderate-severity, local integrity-tampering issue that does NOT warrant emergency prioritization. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) shows the attacker must already have local access and at least low-level privileges (PR:L) on the host - there is no network vector and no path to confidentiality or availability loss, only integrity (I:H). All exploitation signals point the same direction: SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no CISA KEV listing and no POC referenced in the input. No EPSS score was provided, so statistical exploitation probability cannot be weighed. The signals are mutually consistent rather than conflicting: a config/identity-tampering flaw reachable only by an already-authenticated local user, with no evidence of exploitation. One data-quality caveat: the input Tag 'Information Disclosure' contradicts the vector and description, which describe tampering with C:N and I:H - this should be read as an integrity/tampering issue, not disclosure. |
| Exploit ScenarioDerived | An attacker who already holds a valid low-privilege local account on a Windows 10 1809 or Server 2019 system abuses the weak authentication in the Modern Device Management (MDM) component to tamper with device-management data or policy state that should be protected. Because the CVSS vector is AV:L/PR:L, this requires prior local foothold and credentials rather than remote access, and no user interaction (UI:N). No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Weak authentication in the Windows Modern Device Management (MDM) component allows a locally authenticated, low-privilege user on Windows 10 Version 1809 or Windows Server 2019 (including Server Core) to tamper with device-management data and policy. Impact is integrity-only: there is no remote vector, no confidentiality loss and no denial of service, so exploitation requires an attacker to already hold a foothold on the host with a valid low-privilege account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Exploitation is assessed as none under the CISA SSVC framework, the issue is not in CISA KEV, and no public exploit code has been identified at time of analysis, but a vendor patch is available from Microsoft, making this a moderate-severity patch-cycle item rather than an emergency.
RemediationAI
Vendor patch is available from Microsoft; the primary fix is to install the current Microsoft security update for the 10.0.17763.x servicing line so affected Windows 10 Version 1809 and Windows Server 2019 (including Server Core) hosts are brought to build 10.0.17763.9376 or later, per EUVD's affected-version boundary and the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83657. Until every host in the 1809/Server 2019 baseline is updated, apply compensating controls that target the local tampering vector: harden the ACLs on the MDM policy stores and the PolicyManager registry hive so that standard local users cannot write management state, accepting the trade-off that overly tight ACLs can break legitimate MDM enrollment, policy refresh or third-party management agents; and reduce the number of interactive low-privilege accounts with local logon rights on these hosts, which shrinks the set of actors able to reach the vulnerable code path at all. Because Windows 10 Version 1809 and Windows Server 2019 are on the same baseline, consider accelerating migration of the remaining 1809 estate to a currently serviced Windows release, since staying on 10.0.17763.x keeps hosts dependent on this servicing branch. Detection should focus on the DeviceManagement-Enterprise-Diagnostics-Provider and MDM policy logs for unexpected local modifications to managed policy, and on change auditing of the device-management registry keys; these are visibility measures only and do not block exploitation, so they should accompany, not replace, patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-1390 (Weak Authentication) and affects the Windows Modern Device Management (MDM) stack, the on-device client and policy plumbing that enterprises use to push configuration, security baselines and application policy to managed Windows endpoints. MDM policy on Windows flows through the OMA-DM/OMA-URI enrollment channel and is enforced locally through the PolicyManager configuration service providers, which write policy state into the device's management registry and provisioning stores; the local MDM component is expected to verify that a requesting caller is genuinely authorised to read or alter that management state before applying changes. Weak authentication in that verification path (CWE-1390) means a caller holding only a standard, low-privilege local account can satisfy the check and then tamper with management data or policy, effectively letting a non-administrative user modify how the device is managed. The root cause class is authentication weakness rather than memory corruption, privilege-elevation-via-bug, or injection, which is consistent with the assessed impact being integrity-only (I:H) with no confidentiality or availability effect. Note that no CPE strings were supplied with this record; affected build identification comes from EUVD, which bounds the issue to the 10.0.17763.0 baseline used by the Windows 10 Version 1809 / Windows Server 2019 (including Server Core) servicing line, up to but not including build 10.0.17763.9376.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local authenticated low-privilege attacker (AV:L, PR:L) abuses weak MDM authentication to tamper with data, giving I:H with no confidentiality or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB