CVE-2026-65783 is a use-after-free in Windows Autopilot provisioning, and the CVSS-EPSS disconnect (7.0 severity, 0.002 EPSS) is misleading you. The low EPSS reflects the novelty of targeting Autopilot specifically, not genuine low exploitability — and the CVSS 'local' classification with an 'authorized attacker' prerequisite fundamentally mischaracterizes the actual threat model.
The critical point: Windows Autopilot runs with elevated privileges during device enrollment and maintains hooks into the OS security model. When you evaluate this as a standard local EoP, you're assuming the attacker needs to groom heap memory from scratch to achieve arbitrary write — but provisioning-layer UAFs don't follow that lineage. They follow trust boundary code: predictable state machines, cross-process handle inheritance, session-persistent memory references. The exploitation pattern isn't 'groom heap until write'; it's 'trigger a known provisioning state transition and inherit the elevated handle table the enrollment process already created.'
The 'authorized attacker' qualifier is particularly dangerous here. On Autopilot-enrolled enterprise devices, any domain user is already a trusted identity context that the provisioning service expects. The memory state Autopilot maintains isn't hardened against that user — it's optimized for that user's enrollment workflow. You're not breaking into a system; you're resuming an abandoned transaction with pre-existing handle context.
Worse, the blast radius extends well beyond local privilege escalation. Autopilot is wired into MDM enrollment, Azure AD token issuance, and certificate provisioning chains. Successful exploitation doesn't just give you SYSTEM — it can corrupt the enrollment token that device identity hinges on, creating a persistent device identity compromise that survives across sessions and may bypass conditional access controls downstream.
For detection and response: monitor for unexpected Autopilot provisioning state transitions on enrolled devices, particularly outside expected enrollment or reset workflows. For remediation, recognize that enterprise Autopilot patch cycles aren't fast — remediation timing is governed by next provisioning event, not traditional patch deployment. Your conditional access policies trusting device identity are exposed during that window.