CVE-2026-65780

Think of Windows Autopilot as the part of Windows that helps set up and enroll devices. This bug lets a person who already has low-level access on the computer “step up” to full administrator control. With that level of control, they can install malicious software and tamper with or steal data on the device.

This matters if you run or manage Windows 11 computers that use the Windows Autopilot feature (for example, during device setup or enrollment). Because the issue is local and requires low-level access, it’s most relevant if someone can sign into a device you manage (for example, a standard user, or someone who obtained access to a workstation). Treat it as a risk when Autopilot is reachable in your deployment and an attacker can get local low-privilege access; exploitation has been reported in the wild.

This is RED because exploitation has been reported in the wild, meaning attackers are actively targeting this class of bug. Since it can lead to full administrative control and malware installation, you should prioritize patching across Windows 11 devices that could use Windows Autopilot.