CVE-2026-65780

Think of Windows Autopilot as the part of Windows that helps set up and enroll devices. This bug lets a person who already has low-level access on the computer “step up” to full administrator control. With that level of control, they can install malicious software and tamper with or steal data on the device.

This matters if you run or manage Windows 11 computers that use the Windows Autopilot feature (for example, during device setup or enrollment). Because the issue is local and requires low-level access, it’s most relevant if someone can sign into a device you manage (for example, a standard user, or someone who obtained access to a workstation). Treat it as a risk when Autopilot is reachable in your deployment and an attacker can get local low-privilege access; exploitation has been reported in the wild.

This is RED because exploitation has been reported in the wild, meaning attackers are actively targeting this class of bug. Since it can lead to full administrative control and malware installation, you should prioritize patching across Windows 11 devices that could use Windows Autopilot.

Confirm exposure

• Inventory: For each Windows 11 device you manage, record the OS build/version.
• Autopilot usage: Confirm whether the device is enrolled or set up using Windows Autopilot (especially any workflow that triggers Autopilot during provisioning).

Determine if patched

The fixed Windows 11 builds are:

• 10.0.26100.9168
• 10.0.26200.9168
• 10.0.28000.2704
• 10.0.26100.9106
• 10.0.26200.9106

If a device’s build is older than all of the above, treat it as vulnerable and plan an update.

Apply the fix

• Update Windows 11 to one of the fixed builds listed above.
• Use your normal update process (Windows Update for Business, WSUS, or your endpoint management tool), but verify the post-update OS build matches one of the fixed versions.

Temporary workaround (if patching is delayed)

• Reduce the chance an attacker can get local low-level access: limit who can sign in locally, remove unnecessary local accounts, and tighten access around device setup/enrollment workflows.
• If your environment supports it, pause Autopilot/provisioning activities that could trigger the affected Autopilot feature until the patched build is deployed.

After patching

• Review local and endpoint logs for suspicious activity around enrollment/provisioning timeframes (especially any unexpected changes following a local sign-in).
• Watch for repeat attempts: if you see repeated unusual authentication or admin-affecting actions, investigate the user/session and the device immediately.

Timing

• Prioritize devices that are actively used, recently enrolled, or frequently provisioned with Autopilot.

CVE-2026-65780 is a Windows Autopilot local privilege escalation involving a memory management error (described as a double free in the backstop). The weakness type aligns with CWE-415 (Double Free). In practice, an attacker with low-level local access can trigger the flaw to elevate privileges, reaching full control of the computer (including reading, modifying, or deleting data and installing malicious software).

Exploitation status: exploitation reported YES (actively exploited in the wild). KEV is not listed for this CVE.

Attack vector and requirements: Local attack; no special user interaction is needed beyond the attacker’s ability to run on the system with low-level privileges. Default reachability in configuration is not known.

Risk note: Because the attacker must already be on the machine with low privileges, the practical threat is highest on devices exposed to insider threats, stolen endpoints, or weak local account controls.

EPSS is provided as a low predicted likelihood (and is not the primary driver here given the in-the-wild reporting). Fixed builds are listed by Microsoft in the update guide for this CVE.