{"id":"CVE-2026-122175","kind":"vulnerability","aliases":["CVE-2026-122175"],"related":[],"title":"Windows Autopilot: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Autopilot lets an attacker who already has an authorized local account raise their privileges. The sources do not say which Autopilot component or Windows versions are affected.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["autopilot","infrastructure","intune","windows"],"not_affected_if":["no-autopilot-use"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:35+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","triaged_at":"2026-11-10T19:50:16+00:00","updated_at":"2026-11-10T19:50:16+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:50:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Autopilot: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Autopilot lets an attacker who already has an authorized local account raise their privileges. The sources do not say which Autopilot component or Windows versions are affected.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","autopilot","intune"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the Windows machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-122175 for affected Windows builds, the fixed update, and mitigations.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-autopilot-use"],"who_is_affected":"Windows machines that use Autopilot for device provisioning are the likely scope, and an attacker needs a local authorized account first. The sources do not name affected builds or configurations, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4478,"output_tokens":435,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-122175 for affected Windows builds, the fixed update, and mitigations.","search":"'-122175':16A,19A '-2026':15A,18A 'account':42B 'affect':58B 'allow':65C 'alreadi':37B 'attack':35B,68C 'author':40B,67C 'autopilot':2A,20B,32B,52B,64C 'bug':29B 'compon':53B 'cve':14A,17A 'elev':70C 'free':6A,28B,61C 'gain':11A 'higher':12A 'infrastructur':21B 'intun':22B 'let':7A,33B 'local':9A,41B,72C 'privileg':13A,45B,71C 'rais':43B 'say':50B 'sourc':47B 'use':4A,26B,59C 'use-after-fre':3A,25B 'user':10A 'version':56B 'window':1A,23B,31B,55B,63C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that use Autopilot for device provisioning are the likely scope, and an attacker needs a local authorized account first. The sources do not name affected builds or configurations, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["autopilot","high","infrastructure","intune","windows"],"campaign_type":null,"search_a":"'-122175':16A,19A '-2026':15A,18A 'autopilot':2A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'let':7A 'local':9A 'privileg':13A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A","search_b":"'account':42B 'affect':58B 'alreadi':37B 'attack':35B 'author':40B 'autopilot':20B,32B,52B 'bug':29B 'compon':53B 'free':28B 'infrastructur':21B 'intun':22B 'let':33B 'local':41B 'privileg':45B 'rais':43B 'say':50B 'sourc':47B 'use':26B 'use-after-fre':25B 'version':56B 'window':23B,31B,55B","search_c":"'allow':65C 'attack':68C 'author':67C 'autopilot':64C 'elev':70C 'free':61C 'local':72C 'privileg':71C 'use':59C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122175","severity":null,"published_at":"2026-11-10T19:20:35+00:00","modified_at":"2026-11-10T19:20:35+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","fetched_at":"2026-11-10T19:25:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}