Windows Autopilot EUVD-2026-99744

Exploitation requires the attacker to already have local, authenticated low-privileged access to a Windows 11 system (PR:L, AV:L) and to interact with the Windows Autopilot provisioning component. The core limiting factor is the race condition itself (AC:H): the attacker must reliably win a narrow timing window on an improperly synchronized shared resource, which typically demands many repeated attempts and is non-deterministic. No user interaction is needed (UI:N) and scope is unchanged (S:U). Affected builds are Windows 11 24H2 (<10.0.26100.9711), 25H2 (<10.0.26200.9711), 26H1 (<10.0.28000.3231), and 26H2 (<10.0.26300.9711); patched builds are not exploitable. Remote and unauthenticated attackers cannot exploit this.

This is a moderate-priority local elevation-of-privilege issue, not an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already be local and authenticated with low privileges, and must win a race condition (AC:H), which materially reduces reliability and real-world exploitability. All three impact metrics are High (C:H/I:H/A:H), so a successful exploit yields full compromise of the affected system, consistent with the SSVC 'Technical Impact: total' rating. However, the exploitation signals point away from urgency: SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, no EPSS score was supplied, and no public exploit code is referenced. These signals are consistent with one another (high-complexity local race condition = hard to weaponize), so there is no conflict to reconcile here. Note one metadata inconsistency to verify: the input carries an 'Information Disclosure' tag, yet the description and CVSS describe a privilege-elevation (race condition) flaw with full C/I/A impact - treat the tag with caution. Net: real but low-likelihood; patch on standard cadence rather than as an out-of-band emergency.

A low-privileged user already logged onto a Windows 11 endpoint runs a program that repeatedly triggers the Windows Autopilot operation and races a shared resource that is not properly synchronized, aiming to hit the narrow timing window where privileged state can be hijacked. Winning the race lets the attacker execute code or modify state at a higher privilege level, fully compromising the device. No public exploit was identified at time of analysis, and the high attack complexity means exploitation may require many attempts to succeed.