Windows Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-69652Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in Windows Win32K kernel driver allows a locally authenticated user to elevate privileges from a limited user account to full administrator rights. The vulnerability is in the graphics kernel and can be triggered by crafting a malicious graphics operation. Microsoft rates exploitation as unlikely and has released patches for all affected versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025.

What this means
What could happen
A user with limited permissions on a Windows workstation or server could exploit a memory vulnerability in the graphics kernel to gain full administrator rights, potentially allowing them to install malware, steal data, or take control of the machine.
Who's at risk
Windows IT managers and operators of Windows-based systems used in OT environments should be concerned. This affects workstations running Windows 10 or 11, and servers running Windows Server 2016, 2019, 2022, and 2025—all of which are commonly used as engineering workstations, HMI (Human Machine Interface) servers, or gateway systems in industrial control environments.
How it could be exploited
An attacker with an unprivileged local user account on a Windows system could trigger a use-after-free condition in the Win32K kernel driver by crafting a malicious graphics operation, which would cause the kernel to execute code with elevated privileges, allowing the attacker to escalate to administrator level.
Prerequisites
  • Local user account on the target Windows system
  • Ability to run applications or execute code on the affected machine
Elevation of privilegeLocal exploit onlyRequires user-level accountEPSS score low (0.3%)Exploitation unlikely per vendor assessment
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the September 2026 Windows security update to all affected systems
Long-term hardening
0/1
HARDENINGIf immediate patching is not possible, restrict unprivileged user access to systems and disable unnecessary graphics-heavy applications or services to reduce attack surface
API: /api/v1/advisories/85a90d97-ab51-4cc4-b8ba-9231608bfc0b

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.