Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-70114Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Heap-based buffer overflow in Windows Kernel allows an authorized user with login access to elevate privileges locally. Exploitation is assessed as less likely. The vulnerability affects Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2022/2025 across x64 and ARM64 platforms.
What this means
What could happen
A user with login access to a Windows system could exploit a kernel vulnerability to gain administrator privileges, potentially allowing them to modify critical configurations, install malware, or disrupt operations on that device.
Who's at risk
Windows administrators managing Windows 11 and Windows Server 2022/2025 systems used in control room workstations, historian servers, or engineering systems. This affects both x64 and ARM64 architectures across all supported versions.
How it could be exploited
An attacker with a valid user account on a Windows system triggers a heap-based buffer overflow in the kernel by executing a specially crafted operation. This causes the kernel to write beyond allocated memory, corrupting data and allowing the attacker to escalate their privileges from user to administrator level.
Prerequisites
- Valid user account credentials on the target Windows system
- Local access (attacker must log in or have code execution as a user)
Requires valid user credentialsLow complexity exploitationAffects multiple Windows versions and architectures
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (14)
14 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2022
HOTFIXApply the 2026-October Windows security update to all Windows 11 and Windows Server 2022/2025 systems
Long-term hardening
0/1HARDENINGRestrict local administrator access to only necessary staff; disable or restrict user account creation on critical systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/014a74d1-7994-4784-8e2c-af9ca45e093cGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.