CVE-2026-73004 in Windows
Summary
by MITRE • 09/09/2026
Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authentication for a critical function within the Microsoft Windows Autopilot infrastructure represents a significant security flaw that undermines the integrity of device provisioning processes. Windows Autopilot is designed to streamline the deployment and configuration of new devices, allowing organizations to pre-configure settings such as software installations, policies, and user accounts before the end-user ever interacts with the hardware. The core issue lies in the lack of proper authentication checks for specific administrative or operational functions within this system. This deficiency means that while an attacker may possess valid credentials or access rights sufficient to interact with certain parts of the Windows environment, they can exploit these privileges to tamper with critical Autopilot configurations without triggering additional verification steps.
From a technical perspective, this flaw falls under the category of broken access control, specifically aligning with CWE-284 which describes improper access control where authorization is not properly enforced for sensitive operations. In the context of Windows Autopilot, an authorized attacker who has local access to a device or network segment can manipulate configuration profiles intended for mass deployment. By bypassing authentication requirements on these critical functions, the attacker can inject malicious settings, alter existing policies, or disrupt the provisioning workflow. This is particularly dangerous because Autopilot configurations often dictate high-level system behaviors and security postures that are applied automatically upon first boot or during subsequent updates.
The operational impact of this vulnerability extends beyond simple unauthorized access; it facilitates a chain of attacks that can compromise the entire lifecycle management of enterprise devices. An attacker could modify device enrollment settings to redirect new machines to malicious servers, install unwanted software through modified configuration profiles, or disable security features such as BitLocker encryption or Windows Defender real-time protection via altered Autopilot policies. This capability effectively allows for persistent tampering with the baseline state of managed devices, leading to potential data exfiltration, lateral movement within the network, and complete loss of trust in the automated deployment infrastructure. The severity is amplified by the fact that these changes may be applied silently during routine updates or device resets, making detection difficult without rigorous monitoring.
This vulnerability also maps directly to MITRE ATT&CK techniques related to persistence and privilege escalation through configuration manipulation. Specifically, it relates to tactics involving abuse of enterprise trust relationships and modification of system configurations for malicious purposes. Attackers can leverage this flaw to establish a foothold that persists across device reimaging or re-enrollment cycles, as the compromised Autopilot profile will be reapplied automatically. This creates a resilient backdoor mechanism within the organization's endpoint management strategy, allowing adversaries to maintain access even after apparent remediation efforts if the underlying configuration profiles remain unverified and untampered with at the source.
Mitigation strategies must focus on strengthening authentication mechanisms for all critical Autopilot functions and implementing strict integrity checks on configuration files. Organizations should enforce multi-factor authentication for administrative accounts involved in device management and ensure that only trusted administrators can modify deployment packages or user settings within the Microsoft Endpoint Manager admin center. Additionally, enabling audit logging for changes to Autopilot configurations allows security teams to detect unauthorized modifications promptly. Regularly reviewing and validating configuration profiles against known good baselines is essential to identify any tampering early. Furthermore, applying the latest cumulative updates provided by Microsoft ensures that patches addressing these specific access control flaws are deployed, reducing the attack surface available to potential adversaries exploiting this weakness.