OTPulse

Windows Kernel-Mode Drivers Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-69971Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Incorrect authorization in Windows Kernel-Mode Drivers allows a local authorized user to disclose sensitive kernel memory information. The flaw affects Windows 11 (all recent versions from 24H2 through 26H2, both x64 and ARM64 architectures) and Windows Server 2025 (standard and Server Core installations). Exploitation requires local system logon; an attacker with a valid local user account can bypass memory access restrictions to read protected kernel data, potentially exposing credentials, encryption keys, or system configuration details. Microsoft has released fixes in the October 2026 security update.

What this means
What could happen
An attacker with local access to a Windows system could read sensitive kernel memory that should be restricted, potentially exposing credentials or system configuration details. This is a local information disclosure only—no remote access or system compromise.
Who's at risk
Windows Server 2025 and Windows 11 (all recent versions including 24H2, 25H2, 26H1, and 26H2) are affected. This matters most to utilities that run SCADA historian servers, HMI workstations, or engineering stations on Windows Server 2025 or Windows 11. Systems running real-time control logic (PLCs, RTUs) typically run embedded OSes and are not directly affected, but Windows-based gateway or supervisory systems could leak sensitive operational data.
How it could be exploited
An attacker must first gain local logon access to the Windows system (e.g., via compromised user account or physical access). From there, they can exploit the kernel-mode driver authorization flaw to read memory regions that are normally protected, revealing sensitive information such as encryption keys or cached credentials.
Prerequisites
  • Valid local user account or physical access to the system
  • Local logon capability (interactive or service account)
  • No elevated (admin) privileges required—standard user access is sufficient
Local access requiredLow EPSS score (0.4%)Medium severity information disclosureAffects multiple Windows 11 and Server 2025 versions
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9711
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9711
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26100.9711
Windows 11 Version 24H2 for x64-based SystemsAll versionsBuild 10.0.26100.9711
Windows Server 2025All versionsBuild 10.0.26100.33650
Windows 11 version 26H1 for x64-based SystemsAll versionsBuild 10.0.28000.3231
Windows 11 Version 26H1 for ARM64-based SystemsAll versionsBuild 10.0.28000.3231
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2025
HOTFIXApply the October 2026 Windows security update to all affected Windows 11 and Windows Server 2025 systems
All products
HOTFIXPrioritize patching systems that run SCADA interfaces, RTUs, or edge gateways connected to the control network
Long-term hardening
0/2
HARDENINGRestrict local logon access to Windows systems by enforcing strong password policies and disabling unnecessary local accounts
HARDENINGMonitor local logon attempts on OT-adjacent Windows servers using Windows Event Logs (Event ID 4624) to detect unauthorized access
View full vendor advisory
API: /api/v1/advisories/fc1b7663-68bf-4cd2-8b6d-eae4083d0819

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.