This will probably sound like a vague answer, but without further analyses of the suspect program/executable, its activity done on-system, packet captures of the suspicious network traffic, etc., this is the 'best' answer I can come up with.
Any 'unknown' program running on a corporate system of any type is inherently a security risk. Therefore, the existence of the program can in and of itself be considered its own security risk. Whether the program is simply 'sitting on the computer' doing nothing, or actively running and doing something is another matter to take into consideration when responding to the existence of the program.
Without more detailed dissection and analysis, it is not possible to give you a definitive answer for your first question of "Is disabling the program enough to mitigate the security risk". However, typically just 'shutting off' the suspicious program is not enough to stop the core cause of the risk; without more in-depth analysis, however, to say whether this is enough to disable the security risk is pure speculation (and more often than not it is safer to assume "No, this is not enough", from my experience).
However, this is not the right question to be asking. The proper question that the IT team (and/or any relevant information security officers or teams) should be asking is "How did this program get there?" This question is important because if it is a program installed by an end user that happened to have admin privileges, that's one thing. If it's a program that got in there without anyone's knowledge, then you have enough to suggest that there may have been a breach somewhere - whether a user went to a site that exploited a vulnerability in the specific system or not or whether the system was hacked into by an external source or not is still to be determined.
As to your second question about whether a known Windows 10 exploit/attack vector was used to get this program to run in your environment, we can't answer that. Any statements saying "yes" or "no" are pure speculation, and cannot be backed by any evidence. Such evidence would be gained through analysis of the system to determine any suspicious network traffic to/from the system, any suspicious remote logins, suspicious system calls, etc., of which we can then use the data found in those investigations to determine whether or not a "known issue" was exploited or not.
As a whole, therefore, the best thing I can say in answer to your questions is this:
Disabling the program or service, alone, is probably not enough to mitigate the risk. However, this is not a certain answer, and without more in-depth analysis the best conclusion I can give you is that there is a potential security risk of unknown scope and risk factor on the system in question, of which additional analysis of the program's activity and behavior can help to determine such scope and/or risk factors.
If I absolutely had to make recommendations to your IT team, then it would be these, to start:
- Remove the affected system from the network, and provide a new, clean machine if possible to replace this affected machine.
- Submit the suspicious executable to VirusTotal or similar for analysis.
- Analyze network traffic on the affected endpoint system(s) or on the network at-large to identify suspicious traffic, and from there determine potential infection vectors or system breaches through which threat actors could utilize to hijack endpoint systems or to 're-implant' the application in other systems.
But these alone are not fully-informed suggestions backed by evidence, and are more 'general' suggestions that many in the Information Security field will be giving you in response to any suspected breaches or infections; in each and every case, deeper, more in-depth analysis of the affected system and suspect executable/program is necessary to give any truly informed recommendations.