CVE-2026-108134

HighCVSS 7.0/10Last modified Oct 28, 2026

Description

Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1081357.0Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges CVE-2026-1081367.8Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-108147.0A vulnerability has been found in milvus-io milvus up to 2.6.13. This vulnerability affects unknown code of the file internal/metastore/kv/rCVE-2026-1081405.9A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to wCVE-2026-1081415.9A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to wCVE-2026-1081429.1A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.CVE-2026-1081475.3An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParCVE-2026-108156.3A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects someCVE-2026-1081515.3Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows CVE-2026-1081567.1LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts tCVE-2026-1081578.1Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to CVE-2026-1081586.5plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting partici
CVE-2026-108134: High severity, CVSS 7.0 | Vulnix