Elevation of Privilege Vulnerability in Windows Modern Device Management by Microsoft
CVE-2026-108133

7.8HIGH

Key Information:

Vendor

Microsoft
Status
Windows Server 2022
Vendor
CVE Published:
13 October 2026

What is CVE-2026-108133?

The release of an invalid pointer or reference in Windows Modern Device Management (MDM) can allow an authorized attacker to elevate their privileges locally, leading to unauthorized access to sensitive system resources. This vulnerability poses a significant threat as it can be exploited by users with already established access rights, emphasizing the importance of security measures and timely updates to mitigate potential risks.

Affected Version(s)

Windows Server 2022 x64-based Systems 10.0.20348.0 < 10.0.20348.5761

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.