OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-69578Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A numeric truncation error in the Windows Kernel allows a user with local access to elevate their privileges. The vulnerability requires local authentication and administrator-like actions but no user interaction.

What this means
What could happen
An attacker with a local user account on a Windows system running HMI software, engineering workstations, or servers could gain higher privileges and potentially control plant systems or access sensitive configuration data.
Who's at risk
Windows HMI workstations, engineering stations, human-machine interface servers, and any Windows-based industrial computers (Windows 10, Windows 11, Windows Server 2016–2025) used in control systems or network infrastructure. This affects both office IT and control-room systems running unpatched Windows versions.
How it could be exploited
An attacker with an unprivileged local user account exploits a numeric truncation flaw in the Windows kernel to escalate privileges to system level, gaining the ability to execute arbitrary commands with elevated rights and potentially modify system or industrial control software.
Prerequisites
  • Local user account on the affected Windows system
  • Ability to execute code or scripts on the system
  • The affected Windows version must be unpatched
Low attack complexityRequires local authenticationAffects widely deployed Windows versionsAllows full privilege escalation
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/5
Do now
0/2
HARDENINGRestrict local login access to Windows-based industrial computers to authorized personnel only; disable unnecessary local accounts
HARDENINGReview and enforce strong password policies for all local accounts on HMI and engineering workstations
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the September 2026 Windows security update to all affected systems during a scheduled maintenance window
HOTFIXPrioritize patching HMI workstations, engineering stations, and any Windows systems with network access to control systems
Long-term hardening
0/1
HARDENINGMonitor and audit local privilege escalation events using Windows Event Viewer or SIEM tools to detect exploitation attempts
View full vendor advisory
API: /api/v1/advisories/bf2be55e-c159-4d2d-803d-92990ccefd5d

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kernel Elevation of Privilege Vulnerability | CVSS 7 - OTPulse