CVE-2026-73022: Windows MDM Use After Free Vulnerability

CVE-2026-73022 Overview

CVE-2026-73022 is a use-after-free vulnerability [CWE-416] in the Windows Modern Device Management (MDM) component. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows systems. Successful exploitation yields high impact to confidentiality, integrity, and availability of the target host.

The issue requires local access and low privileges, but the attack complexity is high because exploitation depends on winning a memory-state race. No user interaction is required. Microsoft published the advisory in its Security Update Guide.

Critical Impact
An authorized local user can leverage a freed MDM object to execute code in a higher-privilege context, resulting in full compromise of the local system.

Affected Products

Microsoft Windows (Modern Device Management component)
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Vendor advisory does not enumerate CPE identifiers in the NVD entry at publication

Discovery Timeline

2026-09-08 - CVE-2026-73022 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-73022

Vulnerability Analysis

The vulnerability resides in the Windows Modern Device Management (MDM) subsystem, which manages enrollment, policy sync, and configuration for managed devices. The defect is a use-after-free condition, in which the component continues to reference a heap object after it has been released. An attacker who can trigger the free while retaining a stale reference can influence memory contents at the freed address.

Because MDM runs with elevated privileges to apply device-wide policy, corrupting its internal state allows an authorized local user to redirect execution or manipulate privileged data structures. The result is local elevation of privilege from a standard user context to a higher-privilege service context.

Exploitation requires the attacker to already hold valid credentials on the target. The attack complexity is rated high, reflecting the race and heap-shaping conditions needed to reliably reclaim the freed allocation.

Root Cause

The root cause is improper object lifetime management within the MDM component, categorized as CWE-416 Use After Free. A code path releases a heap-allocated object but continues to hold or later dereferences a pointer to that memory. If an attacker allocates controlled data into the freed slot before the dangling pointer is used, the component operates on attacker-influenced memory.

Attack Vector

The attack vector is local. A low-privileged authenticated user invokes MDM functionality in a specific sequence to force premature release of an internal object, then reclaims the freed allocation with controlled content. When the vulnerable code path subsequently dereferences the stale pointer, the attacker gains a primitive suitable for elevating privileges.

No verified proof-of-concept code is available. Microsoft has not disclosed exploitation in the wild, and the vulnerability is not listed on the CISA KEV catalog. Refer to the Microsoft Security Update Guide for vendor technical detail.

Detection Methods for CVE-2026-73022

Indicators of Compromise

Unexpected crashes or exception events in MDM-related processes such as omadmclient.exe or deviceenroller.exe in the Windows Application and System event logs.
New privileged processes spawned from a user session shortly after MDM policy operations.
Unusual MDM enrollment, sync, or policy-refresh activity initiated by standard user accounts.

Detection Strategies

Baseline normal MDM process behavior and alert on anomalous child-process creation, token elevation, or code execution originating from MDM service contexts.
Correlate Windows Error Reporting entries pointing to heap corruption or access violations within MDM binaries with subsequent privilege changes on the same host.
Monitor for repeated triggering of MDM APIs from a single low-privileged user session, which may indicate exploitation attempts against the race condition.

Monitoring Recommendations

Forward Sysmon process creation, image load, and process access events for MDM components to a centralized analytics platform.
Track local group membership changes and creation of new privileged accounts on endpoints where anomalous MDM activity is observed.
Review endpoint telemetry for post-exploitation behaviors such as credential access, LSASS interaction, and persistence following MDM anomalies.

How to Mitigate CVE-2026-73022

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide on all affected Windows systems.
Prioritize patching for multi-user systems, jump hosts, and shared workstations where local attackers are most likely to obtain a foothold.
Audit local accounts and remove standing local privileges that are not required for business operations.

Patch Information

Microsoft has released a security update addressing the use-after-free condition in the Windows Modern Device Management component. Consult the vendor advisory for the specific KB numbers and Windows builds covered by the fix, and validate deployment through your patch management system.

Workarounds

No official vendor workaround is published; patching is the supported remediation path.
Restrict interactive and remote logon rights on affected hosts to reduce the population of users who can attempt local exploitation.
Enforce application control policies to limit which binaries unprivileged users can execute on managed endpoints.

bash

# Verify installed updates on a Windows host after patching
wmic qfe list brief /format:table

# PowerShell equivalent
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20