OTPulse

Windows Server Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-50311Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Improper access control in Windows Server allows an authorized attacker to elevate privileges locally. Affects Windows 10 (all versions from 1607 through 22H2), Windows 11 (versions 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. Microsoft has released security updates for all affected versions.

What this means
What could happen
A user with local access to a Windows Server could exploit improper access control to gain administrator privileges, allowing them to modify system settings, stop services, or alter plant control logic running on that server.
Who's at risk
Windows Server administrators and IT staff managing Windows 10/11/Server 2016/2019/2022/2025 infrastructure. This is particularly relevant if any OT systems, historian servers, data aggregation platforms, or engineering workstations run on these Windows versions in your facility network.
How it could be exploited
An attacker with a valid user account on the Windows Server (e.g., a disgruntled employee or someone who has compromised a service account) could execute code that exploits the access control flaw to elevate to system/administrator privileges without additional credentials.
Prerequisites
  • Valid local user account on the affected Windows Server
  • Local code execution capability (ability to run a program on the server)
Local exploitation requiredLow complexityAffects all supported Windows Server and Windows 10/11 versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Windows Server security update for July 2026 (or later) to all affected systems
View full vendor advisory
API: /api/v1/advisories/5f26b00f-a255-48ee-a704-b49ad1aeebff

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.