Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-50393Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

Use-after-free vulnerability in Windows Kernel-Mode Drivers allows a local user with standard privileges to elevate to system privileges through exploitation of a kernel-mode driver flaw. This affects Windows Server 2025 (all installations), Windows 11 versions 24H2, 25H2, and 26H1 across both x64 and ARM64 architectures. Exploitation is considered unlikely.

What this means
What could happen
A local user with standard privileges could exploit this vulnerability to gain administrative control of a Windows system, potentially allowing them to modify process data, disable safety interlocks, or shut down critical infrastructure.
Who's at risk
IT managers running Windows Server 2025 or Windows 11 systems (versions 24H2, 25H2, or 26H1) in control system networks. This affects both x64 and ARM64 architectures. Systems used for SCADA workstations, engineering stations, or HMI hosts are most at risk because they typically have local user accounts.
How it could be exploited
An attacker with a local user account on a Windows system could trigger a use-after-free condition in a kernel-mode driver to execute code with system privileges. This requires interactive access to the machine but does not require administrator credentials initially.
Prerequisites
  • Local user account on the affected Windows system
  • No administrator privileges required at initial access
Local privilege escalation requiredRequires existing local user accountAffects Windows Server and client operating systems in OT environmentsHigh complexity exploitation
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33158
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.8875
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.8875
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26100.8875
Windows 11 Version 24H2 for x64-based SystemsAll versionsBuild 10.0.26100.8875
Windows Server 2025All versionsBuild 10.0.26100.33158
Windows 11 version 26H1 for x64-based SystemsAll versionsBuild 10.0.28000.2269
Windows 11 Version 26H1 for ARM64-based SystemsAll versionsBuild 10.0.28000.2525
Remediation & Mitigation
0/6
Schedule — requires maintenance window
0/5

Patching may require device reboot — plan for process interruption

Windows Server 2025
HOTFIXUpdate Windows Server 2025 (all installations) to Build 10.0.26100.33158 or later
All products
HOTFIXUpdate Windows 11 Version 24H2 (x64 and ARM64) to Build 10.0.26100.8875 or later
HOTFIXUpdate Windows 11 Version 25H2 (x64 and ARM64) to Build 10.0.26200.8875 or later
HOTFIXUpdate Windows 11 Version 26H1 (x64) to Build 10.0.28000.2269 or later
HOTFIXUpdate Windows 11 Version 26H1 (ARM64) to Build 10.0.28000.2525 or later
Long-term hardening
0/1
HARDENINGRestrict local login access to Windows systems to authorized personnel only via Group Policy or physical access controls
API: /api/v1/advisories/cc9d58e6-918a-4f84-b410-88431873a3ff

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | CVSS 7 - OTPulse