Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 8.8CVE-2026-54107Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A race condition in Windows Win32k kernel driver allows a user with local access to elevate privileges from standard user to SYSTEM level. This affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025. Microsoft has issued patches for all affected versions in the July 2026 security update. Exploitation is assessed as less likely but possible if an attacker has local system access or valid credentials for remote desktop.
What this means
What could happen
A user with local access to a Windows system (such as an operator at an HMI or engineering workstation) could exploit this flaw to gain administrative privileges, allowing them to modify SCADA configurations, alter process logic, or disable monitoring.
Who's at risk
This affects Windows workstations and servers used as HMI platforms, engineering workstations, historians, and any OT network nodes running Windows 10 or Windows Server (2016, 2019, 2022, 2025) that support operator logins. Particular concern for utilities and water authorities using Windows-based SCADA front-ends and remote access stations.
How it could be exploited
An attacker with a standard user account on a Windows 10 or Windows Server system triggers a race condition in the Win32k kernel driver by executing malicious code locally. This allows them to gain SYSTEM-level privileges without administrative rights. An OT example: an operator with local login to an HMI workstation running Windows 10 could escalate to admin and then modify PLC or historian configurations.
Prerequisites
- Local access to the system (physical workstation login, remote desktop, or local service account)
- Standard user privileges or higher
Requires local accessLow exploitation complexityAffects OT workstations and servers with persistent operator presenceNo authentication bypass; requires existing user account
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Public Proof-of-Concept (PoC) on GitHub (1 repository)
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/2HARDENINGRestrict local console and Remote Desktop access to HMI/engineering workstations to authorized personnel only
HARDENINGDisable Remote Desktop on systems that do not require it, or restrict RDP access via firewall to a trusted subnet
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft July 2026 security update to all Windows 10, Windows 11, and Windows Server systems in your OT environment
HOTFIXPrioritize patching HMI workstations and engineering stations that run Windows 10 Version 22H2, 21H2, or Windows 11
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/7ebab420-7bee-430b-8ba0-890264d7df30Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.