CVE-2026-65779: Windows 11 24h2 Privilege Escalation Flaw

CVE-2026-65779 Overview

CVE-2026-65779 is a use-after-free vulnerability [CWE-416] in Windows Autopilot, the Microsoft device provisioning service used to configure and enroll new endpoints. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows 11 systems. The issue affects Windows 11 versions 24H2, 25H2, and 26H1 on both x64 and ARM64 architectures. Microsoft published the advisory on August 11, 2026.

Critical Impact
A local, authenticated attacker who wins a race condition against a freed Autopilot object can execute code at higher privilege, leading to full compromise of confidentiality, integrity, and availability on the target host.

Affected Products

Microsoft Windows 11 24H2 (x64, ARM64)
Microsoft Windows 11 25H2 (x64, ARM64)
Microsoft Windows 11 26H1 (x64, ARM64)

Discovery Timeline

2026-08-11 - CVE-2026-65779 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-65779

Vulnerability Analysis

CVE-2026-65779 is a use-after-free defect in Windows Autopilot. Autopilot handles device enrollment and configuration flows that run with elevated system context. The vulnerability arises when a component of the Autopilot service references a memory object after that object has been released. If an attacker can control the contents of the reallocated memory, they can redirect execution or manipulate privileged data structures.

Exploitation requires local access and low-level privileges on the target machine. The attack complexity is high because it depends on timing the free and reuse of the target object. No user interaction is required. Successful exploitation yields high impact to confidentiality, integrity, and availability, consistent with a privilege escalation to a higher-integrity context.

At publication, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Public proof-of-concept code is not available, and the EPSS probability remains low.

Root Cause

The root cause is improper memory lifetime management inside an Autopilot code path. A pointer to a heap object continues to be dereferenced after free, violating the object's ownership contract. Attackers who reclaim the freed allocation with attacker-controlled data can influence subsequent operations that trust the dangling pointer.

Attack Vector

The attack vector is local. An authenticated user on the endpoint triggers the vulnerable Autopilot code path and races the free-and-reuse window to place controlled data into the reclaimed slot. The vulnerability mechanism is described in the Microsoft CVE-2026-65779 Advisory. No exploit code is publicly available at this time.

Detection Methods for CVE-2026-65779

Indicators of Compromise

Unexpected child processes spawned by Autopilot-related services or provisioning binaries running under SYSTEM.
Crashes or Windows Error Reporting entries referencing Autopilot components followed by privilege changes for the invoking user.
New scheduled tasks, services, or local accounts created shortly after Autopilot activity by a non-administrative user.

Detection Strategies

Hunt for local users invoking Autopilot provisioning APIs outside of expected device-enrollment windows.
Correlate process crashes in Autopilot components with subsequent token manipulation or integrity-level changes on the same host.
Monitor for anomalous handle duplications and access-token adjustments originating from user-context processes.

Monitoring Recommendations

Enable Microsoft Defender for Endpoint or equivalent telemetry to capture kernel and service crash events tied to Autopilot.
Ship Windows Security, System, and Application event logs to a centralized SIEM for correlation across hosts.
Alert on any successful privilege elevation on Windows 11 24H2, 25H2, or 26H1 endpoints that lack the vendor patch.

How to Mitigate CVE-2026-65779

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-65779 Advisory to all Windows 11 24H2, 25H2, and 26H1 endpoints.
Inventory devices still running unpatched builds and prioritize systems used by standard users with local logon rights.
Restrict interactive and remote logon on high-value endpoints until patches are deployed.

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Administrators should deploy the update via Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune. Refer to the Microsoft CVE-2026-65779 Advisory for the specific KB article and build numbers per Windows 11 release.

Workarounds

Limit local logon to administrative users on systems where the patch cannot be applied immediately.
Disable or restrict Autopilot provisioning workflows on endpoints that have already completed initial enrollment.
Apply application control policies to block unauthorized binaries from invoking Autopilot service interfaces.

bash

# Verify installed Windows build and confirm the update is present
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
wmic qfe list brief /format:table