A race condition in Windows Autopilot allows an authorized attacker to elevate privileges locally by exploiting improper synchronization around a shared resource. The flaw can lead to execution of higher‑privileged code on the affected system.

Microsoft Windows 11 versions 24H2, 25H2, 26H2, and 26H1—including ARM64‑based systems—are vulnerable.

The CVSS score of 7 indicates high severity. EPSS data is unavailable and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector requires an attacker with local, authorized access to trigger the race condition in Autopilot services, resulting in privilege escalation.