Windows Kernel Elevation of Privilege Vulnerability

An authorized user with local access to a Windows system could elevate their privileges to run code at the kernel level, potentially gaining full control of the device. In an OT environment, this could allow an insider or an attacker with initial local access to modify control logic, bypass security controls, or disable safety functions.

Windows administrators and operators who manage Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems should prioritize this patch, especially for any servers that run OT software, provide remote access to control systems, or host engineering workstations connected to industrial networks.

An attacker with an existing user account on a Windows machine exploits a use-after-free flaw in the kernel to escalate from standard user privileges to system-level privileges. This requires the attacker to have already obtained user-level access, either through a prior vulnerability, weak credentials, or insider access. Once escalated, the attacker could modify or stop OT-relevant processes running on that host.