CVE-2026-65781

The 'authorized attacker' qualifier in this CVE creates a triage trap that demands careful unwinding. The CVSS of 7 (High) paired with an EPSS of 0.00199 (near-zero exploitation probability within 30 days) is a textbook mismatch — one that should prompt you to look beyond the score and examine what the vulnerability actually requires. Windows Autopilot is not a consumer feature. It's an enterprise device provisioning framework that runs within MDM contexts (primarily Microsoft Intune). The 'authorized attacker' language almost certainly means the exploit path requires someone who already possesses MDM administrative privileges or the ability to trigger Autopilot re-provisioning — not a standard user escalating from nothing. This changes the severity calculus dramatically: the relevant attack distance is MDM admin to SYSTEM, not user to admin. That distance is short but consequential. An MDM administrator who can invoke Autopilot already controls enrollment, certificate distribution, policy deployment, and wipe capabilities across device fleets. A use-after-free converting that position to SYSTEM on an Autopilot-enrolled device could expose provisioning credentials, manipulate enrollment tokens, and persist in ways that survive MDM policy pushes. The blast radius of a successful exploit is far wider than the CVSS suggests, because it doesn't just escalate one attacker — it threatens the entire enrollment trust model for affected devices. Three concrete actions: First, treat the 'authorized attacker' qualifier as a provisional constraint, not a permanent boundary. Historical patterns across enterprise management CVEs show these qualifiers regularly collapse as attacker techniques mature — paths labeled 'authorized' become 'unauthorized' through innovation. Second, audit who in your organization can trigger Autopilot re-provisioning and treat that access with heightened scrutiny, because the privilege-to-compromise distance from that role is catastrophically short. Third, do not deprioritize this because EPSS is low. Near-zero EPSS reflects current attacker awareness, not the upper bound of risk — particularly given the narrow device-state window required today that widens as tooling catches up. The CVSS 7 isn't wrong, but it's measuring a severity that assumes a different starting position than the one most organizations actually occupy. Your urgency should be driven by the blast radius, not the score.

Reviewed through automated stages and approved by a human before publication.