{"id":"CVE-2026-119945","kind":"vulnerability","aliases":["CVE-2026-119945"],"related":[],"title":"Windows MDM: use-after-free lets an unauthorized attacker run code remotely","description":"Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.","summary":"Windows Modern Device Management has a use-after-free memory flaw that lets an unauthorized attacker reach it over the network. A successful attack lets the attacker execute code on the affected Windows machine.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","intune","mdm","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:17+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","triaged_at":"2026-11-10T19:34:45+00:00","updated_at":"2026-11-10T19:34:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:34:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows MDM: use-after-free lets an unauthorized attacker run code remotely","impact":"high","summary":"Windows Modern Device Management has a use-after-free memory flaw that lets an unauthorized attacker reach it over the network. A successful attack lets the attacker execute code on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","mdm","intune"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker executes code on the Windows machine over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-119945 for affected Windows builds, enrollment conditions, and the fixed update.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines that are enrolled in or expose Modern Device Management (MDM) functionality on the network. The sources do not say which Windows versions or enrollment configurations are affected, so the exposed population is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":4492,"output_tokens":435,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-119945 for affected Windows builds, enrollment conditions, and the fixed update.","search":"'-119945':16A,19A '-2026':15A,18A 'affect':56B 'allow':68C 'attack':10A,40B,48B,51B,71C 'code':12A,53B,74C 'cve':14A,17A 'devic':26B,65C 'execut':52B,73C 'flaw':35B 'free':6A,33B,61C 'infrastructur':20B 'intun':21B 'let':7A,37B,49B 'machin':58B 'manag':27B,66C 'mdm':2A,22B,67C 'memori':34B 'modern':25B,64C 'network':45B,77C 'reach':41B 'remot':13A 'run':11A 'success':47B 'unauthor':9A,39B,70C 'use':4A,31B,59C 'use-after-fre':3A,30B 'window':1A,23B,24B,57B,63C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that are enrolled in or expose Modern Device Management (MDM) functionality on the network. The sources do not say which Windows versions or enrollment configurations are affected, so the exposed population is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","intune","mdm","windows"],"campaign_type":null,"search_a":"'-119945':16A,19A '-2026':15A,18A 'attack':10A 'code':12A 'cve':14A,17A 'free':6A 'let':7A 'mdm':2A 'remot':13A 'run':11A 'unauthor':9A 'use':4A 'use-after-fre':3A 'window':1A","search_b":"'affect':56B 'attack':40B,48B,51B 'code':53B 'devic':26B 'execut':52B 'flaw':35B 'free':33B 'infrastructur':20B 'intun':21B 'let':37B,49B 'machin':58B 'manag':27B 'mdm':22B 'memori':34B 'modern':25B 'network':45B 'reach':41B 'success':47B 'unauthor':39B 'use':31B 'use-after-fre':30B 'window':23B,24B,57B","search_c":"'allow':68C 'attack':71C 'code':74C 'devic':65C 'execut':73C 'free':61C 'manag':66C 'mdm':67C 'modern':64C 'network':77C 'unauthor':70C 'use':59C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119945","severity":null,"published_at":"2026-11-10T19:20:17+00:00","modified_at":"2026-11-10T19:20:17+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","fetched_at":"2026-11-10T19:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}