Windows Kerberos Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-69685Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A heap-based buffer overflow in Windows Kerberos authentication allows a user with a regular account on a local or remote machine to escalate privileges to administrator level. This affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. Exploitation requires local or remote interactive access with valid user credentials but no special configuration.
What this means
What could happen
An authorized user on a Windows machine or server could execute commands with administrator privileges, potentially compromising the entire system and any industrial control devices or databases it manages.
Who's at risk
Water utilities and electric utilities should prioritize this for Windows Server systems running control software, engineering workstations, and SCADA historian servers. Any Windows system that manages automation, data logging, or network access to PLCs or RTUs is at risk.
How it could be exploited
An attacker with a regular user account on a Windows machine logs in locally (or via remote desktop) and triggers a heap-based buffer overflow in the Windows Kerberos authentication service, bypassing privilege checks to gain administrative access.
Prerequisites
- Local or remote interactive access to a Windows machine with a regular user account
- Valid user credentials (unprivileged)
Low complexity to exploitRequires user account (not unauthenticated)Affects Windows workstations and servers in OT networksPrivilege escalation could lead to unauthorized process control
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict remote desktop access to engineering workstations and servers to trusted networks only using firewall rules
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXApply the September 2026 Windows security update (or later) to all Windows 10, Windows 11, and Windows Server systems
HOTFIXPrioritize updates for Windows Server systems and engineering workstations that manage or communicate with industrial control systems
Long-term hardening
0/1HARDENINGEnforce strong password policies and multi-factor authentication for all user accounts on systems managing OT assets
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/951ac541-459b-434a-9279-cc142cf835b7Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.