Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-70060Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A heap-based buffer overflow in the Windows Win32 Kernel Subsystem allows an authorized local attacker to elevate privileges. Exploitation is assessed as more likely.
What this means
What could happen
An attacker with a local user account could escalate to system/administrator privileges, gaining full control over the computer to install malware, steal data, or disrupt operations. On a workstation running SCADA software or engineering tools, this could compromise your ability to safely operate or modify industrial equipment.
Who's at risk
Windows 10 and Windows 11 users on all supported versions (1607, 1809, 21H2, 22H2, 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, and 2025 users. This affects any workstation or server in your OT network that runs Windows, including engineering workstations, HMI servers, data historians, and administrative consoles used to manage industrial equipment.
How it could be exploited
An attacker with a valid user account on a Windows machine triggers a heap buffer overflow in the Win32k kernel subsystem by executing a specially crafted local action (no network required). This allows the attacker to escape the user privilege boundary and gain SYSTEM-level access, from which they could modify or interfere with any software running on that machine, including engineering workstations or HMI (human-machine interface) applications.
Prerequisites
- Valid local user account on the target Windows machine
- Direct or physical access to execute code locally
- Target must be running a vulnerable Windows version
Low complexity attackAffects workstations used for OT administrationHigh impact if compromised (controls engineering tools and access to industrial systems)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the October 2026 Windows security updates to all Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems according to your patch management schedule. Refer to specific build numbers in the affected products list for your version.
All products
HARDENINGEnable User Account Control (UAC) and ensure it is set to the highest level on all Windows workstations, especially those used for industrial control or engineering tasks.
Long-term hardening
0/1HARDENINGRestrict local user account creation and management on engineering workstations and OT servers; use only necessary service accounts and administrative accounts with strong passwords.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/a9154bc6-d1d6-4463-82ac-37753e70331cGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.