OTPulse

Windows TCP/IP Elevation of Privilege Vulnerability

Plan PatchCVSS 7.1CVE-2026-69761Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionRequired
Summary

A use-after-free vulnerability in Windows TCP/IP allows an authorized local attacker to elevate privileges. The attacker must have valid user credentials and can trigger the vulnerability through network-based interactions, leading to privilege escalation on the affected system.

What this means
What could happen
An attacker with valid user account credentials could gain elevated (administrator-level) privileges on your Windows servers, potentially allowing them to modify system configurations, access sensitive data, or interfere with services running on those systems.
Who's at risk
This affects organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. If any of these systems are used as engineering workstations, HMI servers, data historians, or network infrastructure (DHCP/DNS servers) in your utility environment, they require patching. This is particularly relevant for utilities using Windows-based SCADA support systems or administrative networks.
How it could be exploited
An attacker with valid user account credentials sends a specially crafted network request to the Windows TCP/IP stack. The vulnerability in TCP/IP memory handling is triggered, allowing the attacker to execute code with elevated privileges on the target system.
Prerequisites
  • Valid user account credentials on the target system
  • Network access to the affected Windows system
  • Ability to send specialized network packets to TCP/IP stack
Remotely exploitableRequires valid user credentialsAffects common enterprise operating systemsAffects systems commonly found in utility OT networks
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict network access to critical servers using host-based firewalls; limit which user accounts have remote access capabilities
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXPrioritize updates for Windows Server 2019, 2022, and 2025 systems first as these are most commonly used in industrial environments
All products
HOTFIXApply the September 2026 security update to all Windows 10 and Windows Server systems
Long-term hardening
0/1
HARDENINGEnforce strong password policies and monitor for suspicious login attempts to reduce risk of unauthorized credential use
View full vendor advisory
API: /api/v1/advisories/7341693d-3164-46cc-a94c-3a07970e3c74

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows TCP/IP Elevation of Privilege Vulnerability | CVSS 7.1 - OTPulse