A time‑of‑check time‑of‑use (TOCTOU) race condition in the Windows Modern Device Management (MDM) component allows an attacker with authorized local access to manipulate device management settings. The flaw can enable tampering with configuration data, potentially bypassing policy enforcement or changing device registration details, thereby compromising the integrity of the device management process. This vulnerability is identified as CWE‑367.

The flaw affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server (2019, 2022, 2025) including core installations. All builds listed under the Microsoft Windows products identified in the CNA are impacted.

The CVSS score is 4.7, indicating moderate severity, and there is no EPSS data available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits as of the data cut‑off. Because the race condition requires local authorized access, the attack vector is likely local and privileged. An attacker would need administrative privileges or appropriate MDM roles to trigger the race and modify settings, so the risk is limited to environments where users are granted such rights.