CVE-2026-65782

This UAF in Windows Autopilot is a failure in the very infrastructure enterprises depend on to secure new devices at scale, and the 'authorized attacker' qualifier obscures more than it reveals. Autopilot is enterprise provisioning infrastructure—it configures devices before they reach end users, establishing device identity, enrolling them in MDM, and bootstrapping the certificate trust chain that downstream security assumes is solid. The 7.0 CVSS score with a 0.00199 EPSS probability reflects the narrow attack surface (enterprise-only, specific configuration required), not genuine safety. The 'authorized attacker' constraint describes exactly the actors who routinely access provisioning workflows: help desk staff configuring new hires, MDM operators running bulk enrollment, anyone with partial enrollment rights. These are the people whose privilege context this UAF would let them escape— SYSTEM-level escape from within the initialization path that establishes trust for an entire device fleet. The blast radius isn't contained to the compromised endpoint. Compromising Autopilot's provisioning workflow gives attackers a foothold in the trust chain itself—any subsequent device provisioned through shared infrastructure, any certificate issued by an MDM that consumed a compromised enrollment token, becomes collateral. The rollback and migration paths that handle device re-enrollment, profile migration between versions, and recovery from failed provisioning states are the forgotten code layers where memory safety gets sacrificed for resilience. Nobody writes rollback handlers expecting regular production use, so they get fewer fuzz passes and more ad-hoc memory management. A UAF in a legacy code path might be unreachable on a fresh Win11 machine but fully exploitable on any device going through re-enrollment or recovery—which help desk staff trigger routinely as first-line troubleshooting. The deeper concern is that provisioning infrastructure accumulates 'emergency patch debt.' When provisioning fails at customer sites, someone hot-patches a handler, an override flag, a bypass condition to address immediate production failures without standard review. These persist because provisioning is load-bearing infrastructure nobody wants to refactor. Microsoft hasn't indicated whether this is an isolated finding or evidence of broader memory safety debt in the provisioning stack—commit history patterns would show if they've been making similar fixes recently. The EPSS/CVSS disconnect creates dangerous incentives: organizations anchoring on low EPSS to defer patching because 'authorized attacker, narrow surface' will find that probability jumps fast when working exploits surface, and the historical pattern in comparable subsystems is that high-severity, low-probability CVEs eventually get practical exploitability. Prioritize patching Autopilot deployments now, and audit your provisioning infrastructure for devices going through recovery or re-enrollment workflows—they may be hitting code paths that normal provisioning doesn't touch.

Reviewed through automated stages and approved by a human before publication.