Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-102207Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
A race condition vulnerability in the Windows Kernel allows an authorized local user to escalate privileges to administrator level. The flaw exists in concurrent execution of shared resources with improper synchronization, enabling a local attacker to run arbitrary code with elevated privileges. Exploitation is assessed as less likely by Microsoft.
What this means
What could happen
An attacker with local access to a Windows machine could exploit a race condition in the kernel to gain administrator-level privileges, potentially allowing them to install malware, disable security software, or gain full control of the system.
Who's at risk
Any organization running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 on their engineering workstations, HMI servers, or any Windows-based industrial control systems. This affects both standard and Server Core installations across multiple processor architectures.
How it could be exploited
An attacker with a local user account on the machine exploits a race condition in the Windows kernel by running a specially crafted program that triggers the synchronization flaw, escalating their privileges from user to administrator without requiring additional credentials or interaction.
Prerequisites
- Local user account on the affected Windows machine
- Ability to run executables on the machine
- No special privileges required to trigger the vulnerability
Requires local access to machineLow complexity attackAuthentication required (local user account)Affects all modern Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update for your Windows version (Build 10.0.14393.9612 for Windows 10 v1607 and Server 2016; 10.0.17763.9376 for Windows 10 v1809 and Server 2019; 10.0.19044.7807 for Windows 10 v21H2/22H2; 10.0.20348.5761 for Server 2022; 10.0.22631.7652 for Windows 11 v23H2; 10.0.26100.9711 for Windows 11 v24H2; 10.0.26200.9711 for Windows 11 v25H2; 10.0.26300.9711 for Windows 11 v26H2; 10.0.28000.3231 for Windows 11 v26H1; 10.0.26100.33650 for Server 2025)
Long-term hardening
0/2HARDENINGRestrict local access to critical systems by reviewing and enforcing strong access controls on user accounts
HARDENINGMonitor for suspicious privilege escalation attempts and unexpected administrator-level process creation from user accounts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/a0fd0f83-c1d4-408d-aa72-2c63fd9e35acGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.