OTPulse

Win32k Information Disclosure Vulnerability

MonitorCVSS 4.7CVE-2026-69853Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A Win32k vulnerability allows an authorized local attacker to disclose information through use of an uninitialized resource. The attacker must have user-level access and local execution capability to exploit this.

What this means
What could happen
An attacker with local access could read sensitive information from Windows memory, potentially exposing credentials or process data from other applications running on the machine.
Who's at risk
Windows IT managers and operators should care about this if they run Windows 10 (versions 1607, 1809, 21H2, 22H2) or Windows 11 (versions 23H2, 24H2, 25H2, 26H1) on user workstations, or Windows Server 2016, 2019, 2022, or 2025 if they host OT applications like HMIs (Human-Machine Interfaces), data historians, or engineering workstations on these platforms.
How it could be exploited
An attacker with a user account on the machine executes code locally that triggers the uninitialized resource in Win32k, allowing them to read memory contents that should not be accessible. This could expose sensitive data from other processes.
Prerequisites
  • Local user account on the Windows system
  • Ability to execute code or scripts on the local machine
Local exploitation onlyLow EPSS score (0.3%)Requires user credentialsAffects Windows client and server platforms
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the September 2026 Windows security update to all Windows Server 2016, 2019, 2022, and 2025 systems
All products
HOTFIXApply the September 2026 Windows security update to all Windows 10 and Windows 11 systems in your environment
View full vendor advisory
API: /api/v1/advisories/b8c6785a-8abc-4d32-9405-7e24e5433203

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Win32k Information Disclosure Vulnerability | CVSS 4.7 - OTPulse