Windows MDM EUVD-2026-99955

Exploitation requires an attacker to already possess a local, authenticated low-privileged account (PR:L) on the target Windows system and to interact with the Modern Device Management (MDM) subsystem. The core limiting factor is the TOCTOU race condition (CWE-367): the attacker must win a narrow timing window between the component's validation of a resource and its use, which the high attack complexity (AC:H) reflects - success is non-deterministic and typically needs many attempts. There is no remote vector (AV:L) and no user-interaction requirement (UI:N). Impact is confined to integrity/tampering (I:H) with no confidentiality (C:N) or availability (A:N) effect. Affected builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025; systems patched to the fixed builds (e.g., 10.0.26100.33650 for Server 2025, 10.0.17763.9376 for 1809) are not exploitable.

This is a genuinely low-priority vulnerability despite a MEDIUM CVSS of 4.7. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) tells a consistent, limiting story: exploitation requires local access (AV:L), already-held privileges (PR:L), and a hard-to-win race window (AC:H), yielding only an integrity impact (I:H) with no confidentiality or availability loss. Every secondary signal agrees with this low-urgency picture: CISA's SSVC decision reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so exploitation probability cannot be quantified, but the TOCTOU/AC:H nature inherently resists reliable or automated weaponization. One cross-source inconsistency: the input Tags include 'Information Disclosure,' yet both the description ('perform tampering') and the CVSS metrics (C:N, I:H) indicate an integrity/tampering flaw, not disclosure - the tag appears mislabeled and should not drive triage. Net assessment: a real but minor local tampering issue, appropriate for routine patch-cycle remediation rather than emergency response.

A local attacker who already holds a standard authenticated account on a Windows host repeatedly triggers an MDM operation while racing to swap a resource between the device management component's validation check and its subsequent use, winning a narrow timing window to tamper with managed state or policy data. No public exploit code has been identified, and the high attack complexity (AC:H) means success requires repeated attempts to hit the race condition rather than a single deterministic action.