CVE-2026-65783

Windows Autopilot Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 16th percentile. A vendor fix is available.

CVSS 3.17.0High EPSS percentile16th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Windows 11 PCs use Windows Autopilot (and whether the device is involved in Autopilot provisioning/enrollment) by reviewing your device enrollment and management configuration.
Verify the installed Windows 11 build/update version on the affected devices.
Update any Windows 11 systems to the fixed versions: 10.0.26100.9168 or 10.0.26200.9168 (preferred), or 10.0.26100.9106 or 10.0.26200.9106 if that branch is what you can deploy.
If you can’t patch immediately, restrict local low-level access to Autopilot-capable devices (limit who can log in and perform local actions) until updates are applied.
After updating, confirm Windows updates are fully installed and re-check affected devices’ OS versions.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

This is a Windows Autopilot bug that can let a user with low-level access turn into an administrator-level user on their local PC; if you just use Windows normally, your risk is limited, but you should install the provided Windows 11 fixes.

CVE-2026-65783 is a local privilege-escalation issue in Windows Autopilot caused by a use-after-free memory handling bug (CWE-416), enabling an authorized local user with low-level access to gain higher system rights.

If you're affected

Full device takeover
Malicious admin-level access
Service disruption
Widespread lateral movement risk

What is it

Windows Autopilot is like the “setup and enrollment assistant” that helps new PCs join your organization automatically. This bug is a memory-handling mistake that can let someone who already has some access on the machine unlock higher privileges (like administrator rights). If a malicious insider or someone who managed to get low-level access is present, they could potentially take full control of the device.

Who is affected

This matters if you run or manage Windows 11 devices that use Windows Autopilot for provisioning/enrollment, especially in environments where not every user is fully trusted. The weakness requires a local attacker with low-level access, so it’s mainly a concern if someone can log on or otherwise gain an initial foothold on the PC. It is not listed as internet-reachable in the findings; it’s a risk when an attacker can already reach the machine locally and the Autopilot flow is relevant.

How urgent is it

Treat this as urgent because it enables a local privilege escalation: a person who already has low-level access can potentially turn that into administrator-level control. The findings also indicate patch-related activity and attention, and there is a confirmed fix available for Windows 11, so delaying increases exposure window.

What to do — in detail

Identify exposure
- Confirm which Windows 11 devices participate in Windows Autopilot provisioning/enrollment in your org.
- Inventory Autopilot-managed endpoints (new devices, re-provisioning events, and any devices currently in enrollment workflows).
Confirm patch status
- For each candidate device, check the installed Windows 11 build/version.
- Compare to the fixed versions provided:
  - Fixed in 10.0.26100.9168
  - Fixed in 10.0.26200.9168
  - Fixed in 10.0.26100.9106
  - Fixed in 10.0.26200.9106
Remediate
- Upgrade/install the Windows update that brings affected devices to one of the fixed versions listed above.
- If you manage updates via a deployment system, prioritize these devices first (those actively using Autopilot or being enrolled).
Temporary workaround (if patching is delayed)
- Reduce the chance a local attacker can gain “low-level access”:
  - tighten who can sign in locally,
  - limit local administrative actions,
  - keep accounts properly permissioned.
- This does not eliminate the bug, but it reduces the likelihood an attacker can reach the required preconditions.
After remediation
- Re-check device build/version to ensure the fixed version is actually applied.
- Monitor for unusual account privilege changes or unexpected admin-level activity on Autopilot-provisioned machines.

CISA KEV note

CVE-2026-65783 is not listed in the CISA KEV list in the provided findings.

Technical context

Severity and type: This is a Windows Autopilot elevation of privilege vulnerability (CWE-416). The core mechanism is a use-after-free memory bug, where freed memory is handled incorrectly, enabling an authorized local user to escalate privileges.

Attack conditions: The findings state a local attack scenario with low authentication requirements and no user interaction. Preconditions include that the attacker must have low-level access to the target system.

Exploitation / maturity: No KEV listing is present, no dated press exploitation claim is provided, and there is no public exploit code on record in the findings. However, the findings indicate actor/patch-related attention in the PULSE source, and a fix is available.

Fix availability: Windows 11 is fixed in specific builds: 10.0.26100.9168 and 10.0.26200.9168, with additional fixed builds 10.0.26100.9106 and 10.0.26200.9106. Use the vendor update guidance linked in the findings to obtain the correct Microsoft update package(s).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS16th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 16th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 2 days, from the signal feeds we watch.

2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Windows 11 Version 24H2OSOn-premOperating Systems / windows

And 3 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.0 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable