OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-50390Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A type confusion vulnerability in the Windows kernel allows a local, authenticated user to escalate their privileges to administrative level. This affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. Microsoft has released fixes for all affected versions and rates exploitation as "More Likely."

What this means
What could happen
An attacker with a local user account on an affected Windows system could exploit a type confusion flaw in the kernel to gain administrative-level privileges, potentially allowing them to modify SCADA or process control software running on that machine.
Who's at risk
IT and OT managers at utilities and water authorities using Windows-based HMIs, data historians, or engineering workstations that interface with SCADA systems. This includes Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems running control or monitoring software.
How it could be exploited
An attacker with an active user session on the Windows machine crafts a malicious request that exploits the type confusion vulnerability in the kernel. By submitting this request, they can escalate their privilege level from a standard user to administrator or SYSTEM, gaining full control of the machine and any control software running on it.
Prerequisites
  • Local user account on the affected Windows system
  • Active user session or ability to run code as an authenticated user
requires local user accessaffects control system computersprivilege escalation to administrative levelMicrosoft actively patching
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the 2026-July Windows security update to all affected systems (Windows 10 Version 1607, 1809, 21H2, 22H2; Windows 11 Versions 24H2, 25H2, 26H1; Windows Server 2016, 2019, 2022, 2025)
Long-term hardening
0/1
HARDENINGRestrict local access to engineering workstations and process control computers—limit who can log in locally to only necessary personnel
View full vendor advisory
API: /api/v1/advisories/507e7a71-b6c4-436b-90d8-ddea599357cd

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.