CVE-2026-65779 is a use-after-free in Windows Autopilot scoring CVSS 7. The rating reflects the requirement for local code execution first — but the provisioning lifecycle context creates chaining opportunities that CVSS doesn't capture and EPSS underweights because it measures current exploitability, not architectural exposure.
Autopilot runs during out-of-box-experience before Windows Defender, HVCI, or AppLocker are active. It handles enrollment token injection, MDM profile parsing, and hardware hash generation with elevated privileges while processing input from potentially hostile infrastructure (BYOD scenarios, untrusted networks). A UAF here means an attacker who achieves any provisioning-time foothold — even a sandboxed one — can corrupt memory that Autopilot dereferences at SYSTEM, then capture the freshly-minted enrollment token that survives into the managed state. That's not just local privilege escalation; it's credential exfiltration against your MDM infrastructure.
The bug haplotype is not new. Windows Setup, Windows Deployment Services, and provisioning packages (.ppkg) have all exhibited the same mutation pattern: memory corruption in object teardown during state transition across trust boundaries. Autopilot carries that lineage. The pattern suggests more Autopilot vulnerabilities will surface — and that hardening investment in the main OS is inadvertently increasing the relative attractiveness of pre-hardening attack paths.
Defenders should prioritize: first, audit your Autopilot provisioning flows for network-adjacent attack vectors (rogue Wi-Fi, man-in-the-middle during enrollment); second, treat any Autopilot UAF as a credential-theft opportunity, not just a local-root bug; third, assume this component will see more CVEs and consider compensating controls around enrollment token handling. The CVSS 7 is a local-scoring artifact, not a measure of enterprise risk in environments where Autopilot provisions devices over untrusted networks.