OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-61929Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

Use after free vulnerability in Windows Kernel that allows an authorized local attacker to elevate privileges. Affects Windows 11 (versions 23H2, 24H2, 25H2, 26H1) on x64 and ARM64 systems, and Windows Server 2025.

What this means
What could happen
An attacker with a local user account on a Windows server or workstation could run commands with system-level privileges, potentially gaining full control of the machine and any industrial devices it manages.
Who's at risk
This affects organizations running Windows 11 (recent versions) or Windows Server 2025, particularly those using these systems as engineering workstations, HMI servers, or central management platforms in industrial facilities. Any Windows-based SCADA client, data historian, or control system workstation is at risk if it runs an affected version.
How it could be exploited
An attacker with a valid user account on the Windows system triggers a use-after-free condition in the kernel to elevate from user-level privileges to system-level (SYSTEM) privileges, gaining unrestricted access to the operating system and all processes running on it.
Prerequisites
  • Valid user account on the Windows system
  • Local access or remote desktop/SSH access to the system
low complexity exploitationrequires user credentials but attacker likely insider or compromised accountkernel-level privilege escalation potential
Exploitability
Some exploitation risk — EPSS score 1.7%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33296
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 23H2 for ARM64-based SystemsAll versionsBuild 10.0.22631.7517
Windows 11 Version 23H2 for x64-based SystemsAll versionsBuild 10.0.22631.7517
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9106
Windows 11 Version 24H2 for x64-based SystemsAll versionsBuild 10.0.26100.9168
Windows Server 2025All versionsBuild 10.0.26100.33296
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the August 2026 Windows security update to all affected systems
Long-term hardening
0/2
HARDENINGRestrict local user account creation and limit which users have login rights to Windows servers and HMI workstations
HARDENINGReview and enforce multi-factor authentication on remote access (RDP, SSH) to administrative systems
View full vendor advisory
API: /api/v1/advisories/6eab8804-ce09-4033-aceb-dada84ac9501

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kernel Elevation of Privilege Vulnerability | CVSS 7 - OTPulse