Microsoft Windows MDM: Use-after-free enables remote code execution

Summary

A use-after-free weakness in the Windows Modern Device Management (MDM) component allows an unauthenticated attacker to execute code over the network. The attack complexity is rated high, and no user interaction or credentials are required. Microsoft rates the flaw as Important, and no active exploitation has been reported at the time of writing.

Affected

• Windows 10 Version 21H2: builds from 10.0.19044.0 before 10.0.19044.7846
• Windows 10 Version 22H2: builds from 10.0.19045.0 before 10.0.19045.7846
• Windows 11 Version 23H2: builds from 10.0.22631.0 before 10.0.22631.7711
• Windows 11 Version 24H2: builds from 10.0.26100.0 before 10.0.26100.9974
• Windows 11 Version 25H2: builds from 10.0.26200.0 before 10.0.26200.9974
• Windows 11 Version 26H1: builds from 10.0.28000.0 before 10.0.28000.3501
• Windows 11 Version 26H2: builds from 10.0.26300.0 before 10.0.26300.9974
• Windows Server 2022: builds from 10.0.20348.0 before 10.0.20348.5870
• Windows Server 2025 (including Server Core): builds from 10.0.26100.0 before 10.0.26100.33822

Fixed in

• Install the November 2026 cumulative update (Patch Tuesday, 10 Nov 2026) for each affected version.
• Fixed builds are the versions listed as the upper limit under Affected (10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870, 10.0.26100.33822).
• Confirm the exact update package per operating system on the Microsoft Security Update Guide.

Workaround

Unknown. No vendor-published workaround was identified; patching is the fix.

Exploitation

• Not known to be exploited at the time of writing.
• No public proof of concept identified.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Patch affected Windows 10, Windows 11 and Windows Server systems with the November 2026 cumulative update, starting with internet-facing and MDM-managed devices.
• Restrict network access to MDM management endpoints where business needs allow.
• Monitor NVD and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119945 msrc.microsoft.com
• CVE.org record CVE-2026-119945 www.cve.org
• Strix CVE summary CVE-2026-119945 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:42.