Windows Kernel Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-108462Oct 13, 2026

Microsoft

IT in OT - Windows Server and Active Directory are widely deployed in OT environments

Attack path

Attack VectorLocal

Auth RequiredLow

ComplexityLow

User InteractionNone needed

Summary

Windows Kernel Information Disclosure Vulnerability (CVE-2026-108462). An authorized local attacker can disclose sensitive system information from kernel memory. The vulnerability exists in the Windows kernel and can be exploited by any user with a local account on the system. The attack does not require elevated privileges. Microsoft has released fixes for all supported Windows versions including Windows 10 (all versions), Windows 11 (all versions), Windows Server 2016, 2019, 2022, and 2025.

What this means

What could happen

An attacker with local access to a Windows system could read sensitive kernel memory that should be protected, potentially exposing system secrets or configuration details used to escalate privileges or compromise other systems on your network.

Who's at risk

This affects all Windows systems running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. If any of these systems are used for OT network management, data historians, SCADA communications, or HMI servers, they should be prioritized for patching. Systems used in operational networks with shared access or interactive logon capability are at higher risk.

How it could be exploited

An attacker who already has a user account on a Windows machine could run a specially crafted command or program to read protected kernel memory. This requires local system access but no special privileges beyond a standard user account. Once kernel information is leaked, the attacker may be able to bypass security protections that depend on kernel memory secrecy.

Prerequisites

Local user account on the Windows system
Ability to run executables or commands on the affected machine
No elevated (administrator) privileges required

remotely exploitable via RDP or terminal services if local attacker gains accountlow authentication required (standard user account sufficient)low complexity attackaffects Windows systems commonly used in operational technology networksaffects all modern Windows versions in widespread use

Exploitability

Unlikely to be exploited — EPSS score 0.5%

Affected products (28)

28 with fix

ProductAffected VersionsFix Status

Windows 10 Version 1607 for 32-bit SystemsAll versionsBuild 10.0.14393.9612

Windows 10 Version 1607 for x64-based SystemsAll versionsBuild 10.0.14393.9612

Windows Server 2016All versionsBuild 10.0.14393.9612

Windows Server 2016 (Server Core installation)All versionsBuild 10.0.14393.9612

Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376

Remediation & Mitigation

0/3

Schedule — requires maintenance window

0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016

HOTFIXPrioritize patching Windows Server 2016, 2019, and 2022 systems in your operational networks within your regular maintenance window

All products

HOTFIXInstall October 2026 Windows security updates on all Windows 10, Windows 11, and Windows Server systems

Long-term hardening

0/1

HARDENINGRestrict local interactive access to critical IT systems to authorized personnel only through group policy or physical access controls

CVEs (1)

CVE-2026-108462

View full vendor advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/87964bb1-81fd-4db3-87a8-75232197e446

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.