Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-58602Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows Kernel Mode Driver allows an authorized local attacker to elevate privileges. Affects Windows Server 2025, Windows 11 versions 24H2, 25H2, and 26H1 across x64 and ARM64 architectures.
What this means
What could happen
An attacker with local access to a Windows server or workstation could gain system-level privileges, allowing them to install malware, modify system configurations, or disrupt operations on that machine.
Who's at risk
Windows server and workstation operators running Windows Server 2025 or Windows 11 (versions 24H2, 25H2, 26H1) on x64 or ARM64 systems. Particularly relevant to municipal IT managers running Windows servers for SCADA, HMI, historian, or engineering workstations in utility environments.
How it could be exploited
An attacker must first gain local access to the system (e.g., via remote desktop, compromised user account, or physical access). Once logged in as a regular user, they can trigger the use-after-free condition in the kernel-mode driver to escalate to system privileges without requiring further credentials.
Prerequisites
- Local user account access to the Windows system
- Ability to execute code or applications on the local system
Local access requiredLow exploit probability (0.2% EPSS)Requires prior account access
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1HARDENINGRestrict local administrator access to authorized personnel only
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2025
HOTFIXApply the 2026-Jul security update for Windows Server 2025 (Build 10.0.26100.33158 or later)
All products
HOTFIXApply the 2026-Jul security update for Windows 11 24H2, 25H2, and 26H1 (Build 10.0.26100.8875 or Build 10.0.28000.2525 depending on version)
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/773733c0-3b53-4c83-b443-5339febb9cabGet OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.