{"id":"CVE-2026-102219","kind":"vulnerability","aliases":["CVE-2026-102219"],"related":[],"title":"Windows MDM: weak encryption lets an attacker run code over network","description":"Inadequate encryption strength in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.","summary":"Windows Modern Device Management (MDM) uses encryption that is too weak to protect its traffic. A remote attacker who is not authorized can run code on the affected Windows system over the network.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","intune","mdm","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:39+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","triaged_at":"2026-11-10T19:35:58+00:00","updated_at":"2026-11-10T19:35:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:35:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows MDM: weak encryption lets an attacker run code over network","impact":"high","summary":"Windows Modern Device Management (MDM) uses encryption that is too weak to protect its traffic. A remote attacker who is not authorized can run code on the affected Windows system over the network.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","mdm","intune"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on managed Windows devices over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-102219 for affected builds, required setup and the patch; the NVD entry gives only the description and CVSS 8.1.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations that use Windows Modern Device Management to manage Windows devices are the ones to look at. The sources do not say which Windows builds, MDM configurations or enrollment setups are affected, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000669,"input_tokens":4501,"output_tokens":437,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-102219 for affected builds, required setup and the patch; the NVD entry gives only the description and CVSS 8.1.","search":"'-102219':14A,17A '-2026':13A,16A 'affect':49B 'allow':64C 'attack':7A,39B,67C 'author':43B 'code':9A,46B,70C 'cve':12A,15A 'devic':24B,61C 'encrypt':4A,28B,56C 'execut':69C 'inadequ':55C 'infrastructur':18B 'intun':19B 'let':5A 'manag':25B,62C 'mdm':2A,20B,26B,63C 'modern':23B,60C 'network':11A,54B,73C 'protect':34B 'remot':38B 'run':8A,45B 'strength':57C 'system':51B 'traffic':36B 'unauthor':66C 'use':27B 'weak':3A,32B 'window':1A,21B,22B,50B,59C","nicknames":[],"mitigations":[],"who_affected":"Organizations that use Windows Modern Device Management to manage Windows devices are the ones to look at. The sources do not say which Windows builds, MDM configurations or enrollment setups are affected, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","intune","mdm","windows"],"campaign_type":null,"search_a":"'-102219':14A,17A '-2026':13A,16A 'attack':7A 'code':9A 'cve':12A,15A 'encrypt':4A 'let':5A 'mdm':2A 'network':11A 'run':8A 'weak':3A 'window':1A","search_b":"'affect':49B 'attack':39B 'author':43B 'code':46B 'devic':24B 'encrypt':28B 'infrastructur':18B 'intun':19B 'manag':25B 'mdm':20B,26B 'modern':23B 'network':54B 'protect':34B 'remot':38B 'run':45B 'system':51B 'traffic':36B 'use':27B 'weak':32B 'window':21B,22B,50B","search_c":"'allow':64C 'attack':67C 'code':70C 'devic':61C 'encrypt':56C 'execut':69C 'inadequ':55C 'manag':62C 'mdm':63C 'modern':60C 'network':73C 'strength':57C 'unauthor':66C 'window':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102219","severity":null,"published_at":"2026-11-10T19:17:39+00:00","modified_at":"2026-11-10T19:17:39+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","fetched_at":"2026-11-10T19:24:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}