OTPulse

Windows Kernel Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-69406Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A Windows Kernel information disclosure vulnerability (CVE-2026-69406) allows a local user with standard (non-administrative) privileges to read sensitive kernel memory contents. The kernel improperly exposes memory through an API without proper access controls. This affects Windows 10 (all supported versions), Windows 11 (all supported versions), Windows Server 2016, 2019, 2022, and 2025. Microsoft reports this is likely to be exploited in the wild.

What this means
What could happen
An attacker with local access to a Windows system could read sensitive kernel memory contents, potentially exposing system configuration data or other protected information that could aid further attacks.
Who's at risk
Windows system administrators managing Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems. This affects any environment where non-administrative users have local login access, particularly multi-user servers or shared workstations.
How it could be exploited
An attacker with a local user account on the machine could invoke a Windows kernel API that improperly exposes memory contents without proper access controls. This requires no remote access and no elevated privileges beyond a standard user account.
Prerequisites
  • Local user account on the affected Windows system
  • No elevated privileges required
Low complexity exploitationNo authentication required beyond standard user accountAffects confidentiality of kernel dataActively being exploited (exploitation likely per Microsoft assessment)
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/2
Do now
0/1
WORKAROUNDIf immediate patching is not feasible, restrict local login access to trusted users only and disable unnecessary local accounts
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the September 2026 Windows security update to your Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems
View full vendor advisory
API: /api/v1/advisories/6e0fc2aa-1b07-4a3a-9058-2b98b44871c8

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kernel Information Disclosure Vulnerability | CVSS 5.5 - OTPulse