OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-62749Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in the Windows kernel allows an authorized local user to escalate privileges to SYSTEM level on Windows Server 2025 and Windows 11 (versions 24H2, 25H2, 26H1). The vulnerability requires local code execution capability and does not require user interaction. Microsoft has released patches in the 2026-August security update.

What this means
What could happen
A user with local access to a Windows server or workstation could exploit a kernel flaw to gain system-level privileges, allowing them to modify system configurations, access sensitive data, or interfere with critical operations running on that machine.
Who's at risk
Organizations running Windows Server 2025 or Windows 11 (versions 24H2, 25H2, or 26H1) on OT workstations, HMI systems, or engineering stations should prioritize updates. This particularly affects water and electric utilities with Windows-based SCADA servers, historian systems, or operator workstations.
How it could be exploited
An attacker with a local user account on the system could trigger a use-after-free condition in the Windows kernel to escalate privileges to SYSTEM level without user interaction.
Prerequisites
  • Local user account on the affected Windows system
  • Ability to execute code on the local system
Low attack complexityLocal access required (insider threat or compromised account)High impact to confidentiality, integrity, and availability
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33296
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9106
Windows 11 Version 24H2 for x64-based SystemsAll versionsBuild 10.0.26100.9168
Windows Server 2025All versionsBuild 10.0.26100.33296
Windows 11 version 26H1 for x64-based SystemsAll versionsBuild 10.0.28000.2704
Windows 11 Version 26H1 for ARM64-based SystemsAll versionsBuild 10.0.28000.2704
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2025
HOTFIXApply the 2026-August Windows security update to all affected Windows Server 2025, Windows 11 Version 24H2, Windows 11 Version 25H2, and Windows 11 Version 26H1 systems
Long-term hardening
0/2
HARDENINGRestrict local user account access to critical Windows servers to only authorized personnel with a documented business need
HARDENINGReview and minimize local administrator and user accounts on SCADA servers and HMI workstations to reduce the pool of accounts that could be exploited
View full vendor advisory
API: /api/v1/advisories/6b7ef1f3-d29e-41b5-825d-e9a380dd7078

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kernel Elevation of Privilege Vulnerability | CVSS 7 - OTPulse