OTPulse

Windows Kerberos Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-62766Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A double-free memory corruption vulnerability in Windows Kerberos authentication allows a user with local account access to escalate privileges to system level without requiring administrator credentials. Affects Windows Server 2025 and Windows 11 (versions 24H2, 25H2, 26H1) on both x64 and ARM64 platforms. Microsoft has released patches in the 2026-August security update.

What this means
What could happen
An attacker with local access to a Windows Server or workstation could escalate privileges through a flaw in the Kerberos authentication service, potentially gaining full system access to compromise control systems or steal credentials.
Who's at risk
Windows Server 2025 and Windows 11 systems used as engineering workstations, data servers, or remote access points in water utilities, power systems, and other critical infrastructure. This impacts both x64 and ARM64 architectures across all recent Windows versions.
How it could be exploited
An authenticated local attacker would trigger a double-free memory corruption in the Windows Kerberos subsystem to elevate privileges from a standard user to system-level access. This could be chained with other exploits to achieve remote code execution or lateral movement in the network.
Prerequisites
  • Local account access (standard user or higher)
  • Ability to execute code on the affected Windows Server or workstation
  • Kerberos authentication enabled on the target system
Low complexity exploitRequires local user accountAffects critical infrastructure support systemsHigh impact to system confidentiality, integrity, and availability
Exploitability
Some exploitation risk — EPSS score 1.5%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33296
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9168
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9106
Windows 11 Version 24H2 for x64-based SystemsAll versionsBuild 10.0.26100.9168
Windows Server 2025All versionsBuild 10.0.26100.33296
Windows 11 version 26H1 for x64-based SystemsAll versionsBuild 10.0.28000.2704
Windows 11 Version 26H1 for ARM64-based SystemsAll versionsBuild 10.0.28000.2704
Remediation & Mitigation
0/3
Do now
0/1
HARDENINGRestrict local login and remote desktop access to Windows servers to authorized administrators only
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-August security update to all affected Windows Server and Windows 11 systems
HARDENINGReview and enforce application whitelisting on engineering workstations to prevent execution of unauthorized code
View full vendor advisory
API: /api/v1/advisories/f687fd8d-f92c-4bf4-9f8a-acc542936326

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kerberos Elevation of Privilege Vulnerability | CVSS 7 - OTPulse