OTPulse

Windows TCP/IP Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-69404Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A race condition in Windows TCP/IP allows an authorized attacker to elevate privileges locally. The vulnerability requires a user with local system access to trigger improper synchronization in shared resources, enabling privilege escalation.

What this means
What could happen
An attacker with a local user account on a Windows workstation or server could gain administrator privileges, allowing them to modify system settings, install malicious software, or access sensitive data and HMI systems on your network.
Who's at risk
Any organization running Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, or 2025 on 32-bit, x64, or ARM64 systems should apply the patch. This includes IT workstations, HMI stations, historian servers, and any engineering workstations that support industrial systems.
How it could be exploited
An attacker with a local user account must execute code that triggers a race condition in the TCP/IP stack during concurrent resource access. This would require timing-sensitive exploitation to escalate to system-level privileges on the local machine.
Prerequisites
  • Local user account on the Windows machine
  • Ability to execute local code or scripts
  • Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 (all architectures)
Local privilege escalationRequires local user accountExploitation less likely per vendor assessmentLow EPSS scoreAffects all recent Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXInstall the 2026-September Windows security update for your Windows version and architecture (Windows 10 Build 10.0.19045.7725 / 10.0.19044.7725 / 10.0.17763.9245 / 10.0.14393.9512, Windows 11 Build 10.0.26200.9445 / 10.0.22631.7582 / 10.0.26100.9445 / 10.0.28000.2954, or Windows Server 2016/2019/2022/2025 as applicable)
Long-term hardening
0/2
HARDENINGReview and restrict local user accounts on Windows servers and workstations to only necessary personnel; disable or remove unnecessary local admin accounts
HARDENINGImplement multi-factor authentication (MFA) for any remote access to Windows workstations and servers to reduce the risk of unauthorized local access
View full vendor advisory
API: /api/v1/advisories/ade98e57-184e-4094-abff-778a3097764e

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows TCP/IP Elevation of Privilege Vulnerability | CVSS 7 - OTPulse