Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7.1CVE-2026-69274Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionRequired
Summary
Use-after-free vulnerability in Windows Win32K kernel component allows an authorized local user to elevate privileges to administrator level. The vulnerability can be exploited over a network by an attacker with valid credentials through a crafted interaction that corrupts kernel memory. Affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across all system architectures (32-bit, x64, ARM64).
What this means
What could happen
An attacker with a local user account could exploit this to gain full system (administrator) privileges on any affected Windows or Windows Server machine. This could allow them to alter network configurations, manipulate data, or disrupt services on systems that support your operations.
Who's at risk
Any organization using Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 in their network. This affects OT environments where engineering workstations, HMI servers, or historian systems run Windows—particularly those that interact with PLCs, RTUs, or process control networks. Also affects IT/OT boundary systems and any compute resources supporting SCADA or DCS infrastructure.
How it could be exploited
An attacker with a valid user account on the machine triggers a use-after-free condition in the Win32K kernel component through a crafted interaction. Once the kernel memory is corrupted, the attacker escalates from user to administrator privileges, gaining full control of the system over the network.
Prerequisites
- Valid local user account credentials
- User interaction required (attacker must trigger a specific action in Win32K)
- Network connectivity to the affected Windows or Server system
low complexity attackrequires valid user credentialshigh privilege impactaffects widely deployed systems (Windows Server 2016-2025, Windows 10/11)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the September 2026 Microsoft security update to all affected Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
All products
HOTFIXPrioritize patching systems running Windows 10 Version 1809, Server 2019, and Server 2022 first, as these are older LTS versions still in widespread production use
Long-term hardening
0/2HARDENINGReview and limit local user account creation on critical systems; ensure only necessary service and administrative accounts exist
HARDENINGEnable Windows Defender Application Guard or AppLocker on workstations to restrict kernel-level execution of untrusted applications
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/bdc87234-4e42-4551-9954-caf72ca9611fGet OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.