OTPulse

Windows Kernel Information Disclosure Vulnerability

MonitorCVSS 4.7CVE-2026-70063Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

CVE-2026-70063 is an out-of-bounds read vulnerability in the Windows Kernel. A local attacker with valid user credentials can trigger the vulnerability to disclose kernel memory contents, potentially exposing sensitive information such as encryption keys or security tokens. The vulnerability does not allow remote exploitation or code execution. Microsoft has released fixes for all affected Windows versions including Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025.

What this means
What could happen
An attacker with local access to a Windows system could read sensitive kernel memory that they should not have access to, potentially exposing security-critical information. This is a local information disclosure only and does not allow remote access or system compromise.
Who's at risk
This affects all supported versions of Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 running on 32-bit, x64, or ARM64 systems. Any organization running Windows servers for HMI (human-machine interface), data logging, or engineering workstations in OT environments should plan patches. Utility organizations running Windows-based SCADA historian or remote terminal unit (RTU) management systems are affected.
How it could be exploited
An attacker with a local user account could trigger an out-of-bounds read in the Windows Kernel by calling specific kernel APIs. The attacker gains access to kernel memory contents that may contain sensitive data like encryption keys or security tokens, but cannot execute code or modify system state.
Prerequisites
  • Local user account on the affected Windows system
  • Ability to execute code or call kernel APIs on the system
  • Moderate complexity to trigger the vulnerability reliably
Low remote exploitability (local only)Requires valid user accountHigh CVSS v3 impact rating on confidentialityAffects all recent Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the October 2026 Windows security update to your Windows systems
HOTFIXPrioritize patching Windows Server systems that host sensitive data or authentication services
Long-term hardening
0/1
HARDENINGRestrict local user account access on systems containing sensitive configuration or credentials
View full vendor advisory
API: /api/v1/advisories/a6ff5e79-e026-47ad-ab7c-8ee32b0d9b92

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.