OTPulse

Windows Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-54112Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A race condition exists in Windows Win32k kernel subsystem that allows a local authorized user to elevate their privileges to SYSTEM level. The vulnerability affects Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server 2019, 2022, and 2025. Microsoft has released patches in the July 2026 security update for all affected versions.

What this means
What could happen
A user with local access to a Windows system could exploit this race condition to gain administrative privileges, allowing them to install malware, modify system settings, or access sensitive data on that machine.
Who's at risk
Any organization running Windows 10 (versions 1809, 21H2, or 22H2), Windows 11 (versions 24H2, 25H2, or 26H1), Windows Server 2019, 2022, or 2025 on workstations or servers. This includes engineering workstations, SCADA operator stations, historian servers, and HMI systems that run on Windows. Most relevant to facilities using Windows-based control systems or data collection servers.
How it could be exploited
An attacker with a local user account on a Windows system could trigger a race condition in the Win32k kernel subsystem by running specially timed code. If successful, the attacker would gain SYSTEM-level privileges without needing administrative credentials first.
Prerequisites
  • Local user account on the Windows system
  • Ability to run executables on the target machine
  • Specific timing conditions that are difficult to achieve reliably
Local privilege escalation requiredRequires existing user account on the systemLow exploitation complexity
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (19)
19 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the July 2026 Microsoft security update to your Windows systems
Long-term hardening
0/1
Windows Server 2019
HARDENINGPrioritize systems running Windows Server 2019 and Windows 10 Version 1809, which are older and more likely to remain unpatched longer
View full vendor advisory
API: /api/v1/advisories/facac4d2-04e0-4f8b-b216-5435a56ed81e

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.