OTPulse

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-69421Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Integer underflow vulnerability in Windows Kernel Mode Driver allows an authorized user with local access to elevate their privileges to administrator level. This affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025.

What this means
What could happen
An attacker with user-level access to a Windows server or workstation could exploit an integer underflow in a kernel-mode driver to gain administrator-level privileges, allowing them to install malware, modify system configuration, or interfere with OT applications running on that device.
Who's at risk
Windows IT administrators managing servers or HMI workstations (engineering PCs) that run Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025. This affects any organization using Windows as a platform for OT applications, SCADA HMI software, or control system engineering workstations.
How it could be exploited
An attacker with user-level credentials on the target Windows system exploits an integer underflow vulnerability in a kernel-mode driver by providing specially crafted input, causing privilege escalation from user to administrator level.
Prerequisites
  • User-level local access to the Windows system (non-administrator account)
  • Ability to trigger the vulnerable kernel-mode driver code
remotely exploitable via lateral movementlow complexityrequires user-level credentialsaffects all modern Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the September 2026 Windows security update to all affected systems
View full vendor advisory
API: /api/v1/advisories/9e858bb9-172e-4765-9327-25f1f4737f8f

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse