CVE-2026-65778

The vulnerability is a use-after-free in Windows Autopilot's provisioning subsystem that enables a local attacker to escalate to SYSTEM privileges. It exploits the enrollment state machine during or shortly after device provisioning—when Autopilot is applying policies, distributing certificates, and registering hardware hashes with Microsoft's cloud infrastructure. The UAF occurs in asynchronous state-transition code handling cloud-service responses, where one subsystem considers an object complete while another still holds a reference to it. This is not an isolated bug. Microsoft has shipped nearly identical UAFs in MDM enrollment (CVE-2021-27082), Windows Update Delivery Optimization (CVE-2022-24509), and now Autopilot provisioning—all following the same pattern: async cloud communication embedded in elevated-context provisioning code, with object lifetime mismatches during state transitions. The 18-36 month window between feature stabilization and these CVEs is consistent across all three. This is a recognizable vulnerability phenotype with predictable timing, triggers, and attacker positioning. What matters for defenders: the 'authorized attacker' qualifier means someone with local access—filesystem or code execution before enrollment completes—can exploit this. The window exists precisely because provisioning must trust external inputs during setup. But exploitation during that narrow window has outsized impact: the attacker isn't just gaining local privileges, they're potentially injecting themselves into the device identity pipeline with organizational trust credentials, receiving policies designated for enrolled hardware, and validating against cloud services as a trusted entity. The practical exposure is compounding. Autopilot code runs once per device lifecycle and rarely in testing or fuzzing pipelines. Remediation velocity is gated by hardware refresh cycles, not normal patch deployment. A disclosed-but-unfixed instance of this known-phenotype vulnerability persists in enterprise fleets for months or years after publication. The pattern will recur in adjacent enterprise features until the architectural choice—embedding stateful enterprise management logic into kernel-adjacent async paths—is fundamentally reconsidered. Prior localized fixes addressed specific dangling pointers without reaching that structural decision.

Reviewed through automated stages and approved by a human before publication.