Windows MDM EUVD-2026-99937

Exploitation requires an attacker to already have authenticated local access (PR:L) to an affected Windows system and to invoke the specific Windows Modern Device Management (MDM) function that is missing its authentication/authorization check (CWE-306). The high attack complexity (AC:H) indicates additional constraints beyond mere access - such as a specific race condition, system state, or timing window that the attacker does not control - which limits reliable exploitation. There is no remote vector (AV:L) and no user interaction required (UI:N), but the need for a pre-existing local low-privileged foothold plus the AC:H conditions meaningfully constrains real-world abuse; impact is confined to integrity/tampering (C:N/A:N).

This is a genuinely moderate, not high-priority, issue and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, base 4.7 Medium) describes a local, high-complexity attack requiring an already-authenticated low-privileged user, with impact limited to integrity (tampering) and no confidentiality or availability loss - matching the CWE-306 'missing authentication for critical function' and the description's 'authorized attacker performs tampering locally.' CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with AC:H and local access), and Technical Impact=partial (consistent with a single integrity-only impact). There is no CISA KEV listing and no EPSS score was supplied in the input, so no probabilistic exploitation signal is available; absence of EPSS is a data gap, not evidence of either high or low likelihood. No public POC is referenced. In short, every available signal (medium CVSS, SSVC exploitation=none/automatable=no, no KEV, no POC) points the same direction: a real but low-urgency, local, integrity-only flaw that should be patched on a normal cadence rather than treated as an emergency. The one caveat worth verifying: the 'Authentication Bypass' tag and CWE-306 imply bypassing a trust boundary, yet the CVSS still assigns PR:L - confirm with Microsoft whether any pre-existing local foothold is truly required or whether the missing authentication lowers the effective privilege bar.

A low-privileged but authenticated local user on a Windows endpoint abuses a Modern Device Management function that fails to properly check authorization, allowing them to tamper with MDM-managed state or policy they should not be able to alter. The high attack complexity (AC:H) means success depends on winning a race or meeting specific runtime conditions rather than a simple one-shot action, and no public exploit code is identified at time of analysis.