CVE-2026-65783

Windows Autopilot is like the “setup and enrollment assistant” that helps new PCs join your organization automatically. This bug is a memory-handling mistake that can let someone who already has some access on the machine unlock higher privileges (like administrator rights). If a malicious insider or someone who managed to get low-level access is present, they could potentially take full control of the device.

This matters if you run or manage Windows 11 devices that use Windows Autopilot for provisioning/enrollment, especially in environments where not every user is fully trusted. The weakness requires a local attacker with low-level access, so it’s mainly a concern if someone can log on or otherwise gain an initial foothold on the PC. It is not listed as internet-reachable in the findings; it’s a risk when an attacker can already reach the machine locally and the Autopilot flow is relevant.

Treat this as urgent because it enables a local privilege escalation: a person who already has low-level access can potentially turn that into administrator-level control. The findings also indicate patch-related activity and attention, and there is a confirmed fix available for Windows 11, so delaying increases exposure window.