Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-70067Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
A use-after-free vulnerability exists in the Windows Win32 Kernel Subsystem that allows an authorized local user to escalate privileges and gain administrative control over an affected Windows system. This affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across both 32-bit and x64-based architectures.
What this means
What could happen
A user with standard access to a Windows workstation or server could exploit this vulnerability to gain full administrative control over that device, potentially allowing them to modify SCADA software, access sensitive process data, or disrupt operations.
Who's at risk
Windows workstations and servers running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. This affects IT infrastructure and any engineering workstations used for HMI (Human Machine Interface) access, SCADA configuration, or PLC programming where local user access is available.
How it could be exploited
An attacker with a local user account on the system triggers a use-after-free flaw in the Win32 kernel subsystem through a specially crafted application or command, escalating from standard user privileges to administrator/SYSTEM level without needing to interact with the device physically or provide additional credentials.
Prerequisites
- Local user account on the affected Windows system
- Ability to execute arbitrary code as a standard (non-admin) user
- No elevation of privilege protection bypass required beyond the vulnerability itself
Local privilege escalationRequires existing local user accessLow exploitation complexity
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update to bring your systems to the patched build versions listed for your OS version and architecture
Long-term hardening
0/2HARDENINGRestrict local user account creation and enforce strong password policies to limit the number of accounts that could potentially exploit this vulnerability
HARDENINGImplement application whitelisting or AppLocker policies on engineering workstations and servers to prevent execution of unauthorized applications that could trigger the exploit
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/47e803a8-dd30-49ac-bd2d-44715acc1eecGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.