Windows Kernel Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-102187Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An uninitialized resource in the Windows Kernel can be exploited by a local authorized attacker to disclose sensitive information from kernel memory. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across 32-bit, x64, and ARM64 architectures. Microsoft has released fixes for all affected versions.
What this means
What could happen
An attacker with local access to a Windows system could read sensitive kernel memory that should be inaccessible, potentially exposing system configuration or cached credentials. This risk is low probability given exploitation requires local system access.
Who's at risk
This affects Windows workstations (Windows 10, Windows 11) and Windows Server systems (2016, 2019, 2022, 2025) running across all supported versions and architectures. Any organization using these Windows systems should patch. The vulnerability is primarily a concern for systems with untrusted local users or where physical access to systems cannot be controlled.
How it could be exploited
An attacker must have a local user account on the Windows system. They would then trigger the uninitialized kernel resource through a local application or command to leak memory contents. The attack requires no network access and is local-only.
Prerequisites
- Valid local user account on the Windows system
- Local code execution capability (ability to run applications or commands)
no authentication required for local attacklow complexity attackaffects information confidentiality only (no code execution)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update to your affected Windows systems (see product list for specific build numbers)
Long-term hardening
0/2HARDENINGRestrict local system access by enforcing strong password policies and disabling unnecessary local user accounts
HARDENINGEnable and monitor Windows audit logging for local login attempts and process execution to detect suspicious activity
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/ca28b8a5-e810-42c3-a5e5-e1ec40a21f47Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.