OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-49173Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Use-after-free vulnerability in the Windows Kernel that allows an authorized local attacker to elevate privileges. The vulnerability exists in Windows 11 Version 26H1 for both x64-based and ARM64-based systems.

What this means
What could happen
An attacker with local access to a Windows 11 system could escalate their privileges to run code with higher permissions, potentially allowing them to modify system settings, access sensitive data, or interfere with HMI/operator systems and engineering workstations used to manage industrial equipment.
Who's at risk
Windows 11 systems running Version 26H1, including operator workstations, engineering machines, and any HMI systems running Windows. This affects both x64 and ARM64-based deployments in utilities with Windows-based SCADA, HMI, or engineering tools.
How it could be exploited
An attacker with a local user account on a Windows 11 26H1 system triggers a use-after-free condition in the kernel to elevate their privilege level. This requires the attacker to already have local access (physical or remote login) but no elevated privileges initially.
Prerequisites
  • Local user account on the affected Windows 11 system
  • No elevated (administrator) privileges required
Locally exploitable onlyLow complexity exploitationPrivilege escalation on workstationsAffects OT engineering and operator systems
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Windows 11 version 26H1 for x64-based SystemsAll versionsBuild 10.0.28000.2269
Windows 11 Version 26H1 for ARM64-based SystemsAll versionsBuild 10.0.28000.2525
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the July 2026 Windows security update to all Windows 11 Version 26H1 systems (x64 and ARM64)
Long-term hardening
0/2
HARDENINGRestrict physical and remote access to Windows 11 systems to authorized personnel only
HARDENINGReview and minimize the number of local user accounts on engineering workstations and HMI systems
View full vendor advisory
API: /api/v1/advisories/2cb0f980-8299-4ede-89b1-7df40b4b1f95

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.