CVE-2026-122175: Windows Autopilot Elevation of Privilege Vulnerability

Q: Who is exposed to this vulnerability?

Systems running Microsoft Windows 11 are identified as affected. Exploitation is local and requires an authorized attacker with existing access to the system.

Q: What access does an attacker need to exploit it?

The attacker must already be authorized on the affected Windows 11 system and able to perform local actions. The supplied vector indicates low privileges are required, no user interaction is required, and attack complexity is high.

Q: What is the likely impact of successful exploitation?

Successful exploitation can elevate the attacker’s privileges locally. The provided severity vector indicates high potential impact to confidentiality, integrity, and availability.

Published Nov 10, 2026

Updated

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Other sources

Windows Autopilot Elevation of Privilege Vulnerability

— Microsoft

Affected Software

2 affected componentsFixes available

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3501Patch KB5132059

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:24 PM

Data Sourced

via MITRE·06:24 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Systems running Microsoft Windows 11 are identified as affected. Exploitation is local and requires an authorized attacker with existing access to the system.

What access does an attacker need to exploit it?

The attacker must already be authorized on the affected Windows 11 system and able to perform local actions. The supplied vector indicates low privileges are required, no user interaction is required, and attack complexity is high.

What is the likely impact of successful exploitation?

Successful exploitation can elevate the attacker’s privileges locally. The provided severity vector indicates high potential impact to confidentiality, integrity, and availability.

CVE-2026-122175: Windows Autopilot Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What access does an attacker need to exploit it?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What access does an attacker need to exploit it?

What is the likely impact of successful exploitation?