OTPulse

Windows Kernel Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-69669Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Heap-based buffer overflow in Windows Kernel that allows an unauthorized attacker to execute code over a network. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2 and all architectures), Windows 11 (versions 23H2, 24H2, 25H2, 26H1 and all architectures), Windows Server 2016, 2019, 2022, and 2025 (including Server Core installations). Exploitation is assessed as less likely but patches are available for all affected products.

What this means
What could happen
An attacker on the network could execute arbitrary code on your Windows servers or workstations with kernel privileges, potentially taking full control of the system and compromising any industrial processes or data running on it.
Who's at risk
Windows IT infrastructure used by water utilities and electric utilities for supervisory systems, data collection, engineering workstations, and server infrastructure. Affects Windows 10 (all supported versions), Windows 11 (all supported versions), Windows Server 2016 through 2025, and Server Core installations.
How it could be exploited
An attacker sends a specially crafted network packet to a vulnerable Windows system. The kernel processes the malicious data in a heap buffer, causing an overflow. This allows the attacker to overwrite memory and execute arbitrary code with kernel-level privileges, without needing to log in first.
Prerequisites
  • Network access to the vulnerable Windows system
  • No authentication required
  • User interaction not required for kernel-level exploitation
remotely exploitableno authentication requiredlow complexityhigh CVSS score (8.8)affects Windows kernel and system stability
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict network access to Windows servers from untrusted networks using firewall rules until patches can be applied
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply Microsoft's September 2026 security update to all affected Windows systems (Windows 10, Windows 11, Windows Server 2016/2019/2022/2025)
All products
HOTFIXPrioritize patching Windows Server systems that run industrial control system software or data historians
Long-term hardening
0/1
HARDENINGSegment Windows workstations and servers from critical OT networks if they are not operationally necessary for process control
View full vendor advisory
API: /api/v1/advisories/10e05afe-8707-49b1-a70e-c3985fa67506

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Kernel Remote Code Execution Vulnerability | CVSS 8.8 - OTPulse