Windows Kerberos Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-108132Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
Double-free vulnerability in Windows Kerberos authentication allows an authorized local user to elevate privileges. The vulnerability exists in the Kerberos subsystem and can be triggered during authentication operations. Exploitation requires a valid local account and low complexity. Microsoft rates exploitation as less likely but has released patches.
What this means
What could happen
A user with local access to a Windows system running vulnerable Kerberos could escalate privileges to run code with higher permissions, potentially compromising plant automation workstations or engineering PCs. This could allow modification of control logic, parameters, or access to sensitive operational data.
Who's at risk
Windows 10 and Windows Server systems running versions 1607, 1809, 2016, 2019, 2022, 2025, and Windows 11 are affected. This includes engineering workstations, HMI systems, and data historian machines that run Windows. Any facility using Windows-based automation or control system integration points should prioritize patching.
How it could be exploited
An attacker with a local user account on a Windows workstation triggers a double-free vulnerability in Kerberos authentication during privilege escalation. This requires the attacker to first gain local access (e.g., via credential compromise or physical access), then use a specially crafted authentication sequence to escalate to a higher privilege level on the same machine.
Prerequisites
- Local user account on the affected Windows system
- Ability to initiate or manipulate Kerberos authentication sequences
- No remote attack capability—attacker must already have local access
Local privilege escalation capabilityRequires prior local accessMemory corruption vulnerability (double free)Affects multiple Windows versions across extended support lifecycle
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (20)
20 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/10
Schedule — requires maintenance window
0/10Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 10 Version 1607 (32-bit) to Build 10.0.14393.9612 or later
HOTFIXUpdate Windows 10 Version 1607 (x64) to Build 10.0.14393.9612 or later
HOTFIXUpdate Windows 10 Version 1809 (32-bit) to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 1809 (x64) to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 21H2 and 22H2 to Build 10.0.19044.7807 or later
HOTFIXUpdate Windows 11 Version 23H2 to Build 10.0.22631.7652 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/cb2e3ec8-cdf5-439b-8e98-9064dcc51d04Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.