Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-69498Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
A use-after-free vulnerability in Windows Win32k allows an authorized local user to escalate privileges on Windows 10, Windows 11, and Windows Server 2019/2022/2025 systems. The vulnerability requires an attacker to already have local access and user-level permissions to exploit successfully.
What this means
What could happen
An attacker with local access to a Windows workstation or server could run code with higher privileges, potentially compromising the entire system and any connected industrial devices it manages.
Who's at risk
Windows IT administrators managing workstations and servers used for OT engineering, SCADA monitoring, and plant network management. This includes engineering workstations running Windows 10 or 11, domain controllers and file servers running Windows Server 2019/2022/2025, and any Windows-based HMI or operator stations.
How it could be exploited
An attacker with an existing local user account on a Windows machine could exploit this use-after-free flaw in the Win32k kernel component to escalate their privileges from a standard user to system administrator level, giving them full control of the machine.
Prerequisites
- Local user account on the affected Windows system
- Ability to execute code on the system
Local privilege escalationRequires valid user credentialsHigh complexity to exploitAffects multiple Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (22)
22 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXInstall the September 2026 Microsoft Windows security update on all affected Windows 10, Windows 11, Windows Server 2019, 2022, and 2025 systems
Long-term hardening
0/2HARDENINGRestrict local login access to workstations and servers to authorized personnel only; disable or remove unnecessary local user accounts
HARDENINGConfigure Windows Defender Application Guard or similar application isolation on engineering workstations to limit the impact of local privilege escalation
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/7aa53fd1-a861-474a-b8bf-cf72f13347a4Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.