Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7.1CVE-2026-68846Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionRequired
Summary
Use-after-free vulnerability in the Windows Kernel allows an authorized attacker to elevate privileges. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 on 32-bit, x64-based, and ARM64-based systems. Exploitation is assessed as more likely and requires valid user account credentials.
What this means
What could happen
An attacker with a user account on a Windows system could exploit this kernel vulnerability to gain administrative privileges, potentially allowing them to modify system configurations, access sensitive data, or interfere with critical processes running on that machine.
Who's at risk
Windows operators and IT administrators managing Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems, particularly in environments where engineering workstations, HMIs, or OT gateway servers run on Windows platforms. Any facility using Windows-based control systems, data historians, or administrative access points should prioritize patching.
How it could be exploited
An attacker must first obtain a valid user account on the target Windows system. They can then trigger the use-after-free condition in the kernel to execute code with elevated privileges, bypassing access controls that normally prevent regular users from making system-level changes.
Prerequisites
- Valid user account credentials on the target Windows system
- Local or remote access to the affected Windows system
Low complexity exploitationRequires valid user credentialsAffects multiple Windows versions and server platformsExploitation likely
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/2
Do now
0/1WORKAROUNDFor systems that cannot be immediately patched, restrict user account privileges and monitor for unauthorized privilege escalation attempts
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft's September 2026 security update to all affected Windows systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/e539a8ff-f96d-48dc-b9ea-6cb5ea0e2f96Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.