OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-50397Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in the Windows Kernel allows an authorized local user to elevate privileges. An attacker with unprivileged access to a Windows system can exploit this without user interaction to gain administrative control. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 on 32-bit, x64, and ARM64 platforms.

What this means
What could happen
A user with low-privilege access to a Windows system could exploit this vulnerability to gain administrative control of the device, potentially allowing them to modify critical infrastructure software, install backdoors, or disrupt normal operations.
Who's at risk
Any organization running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 is affected. This includes workstations used by IT staff, engineering teams, and supervisory personnel at water utilities, electric utilities, and other critical infrastructure operators who may run SCADA software, HMI interfaces, or engineering workstations on Windows servers or desktops.
How it could be exploited
An attacker with an unprivileged user account on the affected Windows system can trigger the use-after-free condition in the Windows Kernel without user interaction. Successful exploitation grants the attacker administrative (system) privileges on the local machine.
Prerequisites
  • Local user account on affected Windows system
  • User logon to desktop or remote access session
  • No special configuration or credentials beyond standard unprivileged user access required
Local privilege escalationLow attack complexityLow EPSS scoreAffects widely deployed Windows systems
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/9
Schedule — requires maintenance window
0/8

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9020 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5386 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33158 or later
All products
HOTFIXUpdate Windows 10 Version 1809 (32-bit) to Build 10.0.17763.9020 or later
HOTFIXUpdate Windows 10 Version 1809 (x64) to Build 10.0.17763.9020 or later
HOTFIXUpdate Windows 10 Version 21H2 to Build 10.0.19044.7548 or later
HOTFIXUpdate Windows 10 Version 22H2 to Build 10.0.19045.7548 or later
HOTFIXUpdate Windows 11 Version 24H2 to Build 10.0.26100.8875 or later
Long-term hardening
0/1
HARDENINGImplement local administrative access controls to restrict unprivileged user accounts and limit local logon capability on critical systems
View full vendor advisory
API: /api/v1/advisories/b3092cec-3226-4ae5-8ee6-f4254e0f7b6f

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kernel Elevation of Privilege Vulnerability | CVSS 7 - OTPulse