Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 9.3CVE-2026-49798Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A use-after-free vulnerability in the Windows Kernel allows an attacker with local access to elevate privileges to system or administrator level. The flaw affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across 32-bit, x64, and ARM64 architectures. Microsoft has released patches for all affected versions in the July 2026 security update.
What this means
What could happen
An attacker with local access to a Windows workstation or server could escalate privileges from a standard user account to administrator or system level, potentially allowing them to control the entire machine and any connected OT/ICS equipment.
Who's at risk
This affects all utilities and municipalities running Windows on engineering workstations, SCADA servers, data acquisition systems, and any administrative machines that touch OT networks. Organizations using Windows Server for HMI (human-machine interface) systems, historian databases, or process control servers should prioritize patching.
How it could be exploited
An attacker with a local user account on a Windows system exploits a use-after-free flaw in the kernel to execute code with elevated privileges. This requires the attacker to first gain local access (via phishing, compromised credentials, or prior exploitation), then trigger the kernel vulnerability to escape user isolation and gain administrative control.
Prerequisites
- Local access to the Windows system (user-level account or above)
- No specific configuration required—vulnerability is present in all affected versions by default
remotely exploitable (after initial local compromise)no authentication required for kernel exploit once local access gainedlow complexity (use-after-free)affects Windows systems in all environments including safety-critical OT infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/2HOTFIXApply the 2026-07 Windows security update immediately to all affected Windows 10, Windows 11, and Windows Server systems
WORKAROUNDRestrict local logon access to only necessary personnel on systems running OT applications, such as engineering workstations and servers managing field controllers
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HARDENINGDisable or restrict access to development tools and remote desktop services on non-administrative machines where possible
Long-term hardening
0/1HARDENINGMonitor for unauthorized privilege escalation attempts and enforce strong credentials for all local accounts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/fe41a050-b85d-46d3-bb51-e51e6ac24156Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.