OTPulse

Windows Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-70104Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker with a local user account to elevate privileges. The vulnerability exists across all supported versions of Windows 10, Windows 11, and Windows Server (2019, 2022, 2025) across 32-bit, 64-bit, and ARM64 architectures. An attacker with local access can exploit this to execute code with administrative privileges. Microsoft rates exploitation as more likely and recommends immediate application of the October 2026 security update.

What this means
What could happen
A user with local access to a Windows system can escalate their privileges to run commands with administrative rights, potentially allowing them to modify industrial software, access sensitive control data, or disable security protections on HMI workstations or engineering stations.
Who's at risk
This affects all Windows versions from Windows 10 to Windows 11 and Windows Server 2019 to 2025. It impacts HMI workstations, engineering stations, historians, and any other Windows-based computer in your control network where unauthorized users have or could gain local access. 32-bit, 64-bit, and ARM64 systems are all affected.
How it could be exploited
An attacker with a local user account on a Windows workstation executes code that dereferences an untrusted pointer in the Win32 kernel subsystem. This causes the kernel to execute arbitrary code in privilege mode, granting the attacker administrative rights. In an industrial setting, this could target engineering workstations, operator HMI computers, or historian servers.
Prerequisites
  • Local user account on the Windows system
  • Ability to execute code or run a specially crafted application
  • System must be running an unpatched Windows version from the affected list
Low complexity exploitationLocal authentication required but from unprivileged user accountNo default credentials involved but privilege escalation to adminAffects IT/OT boundary systems like engineering workstations and HMI servers
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/2
Do now
0/1
WORKAROUNDIf immediate patching is not feasible, restrict local console and remote access to Windows workstations to authorized users only, and review user privilege assignments to limit standard user accounts
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the October 2026 Windows security update to your Windows systems. Specific build numbers vary by version—see product list for your OS version and architecture
View full vendor advisory
API: /api/v1/advisories/b347e8d6-cf96-446b-9960-7d59848171dc

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows Win32k Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse