Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-70176Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
A use-after-free vulnerability in Windows Win32k Kernel Subsystem allows an authorized local user to escalate privileges and gain SYSTEM-level access. The flaw does not require administrator credentials or user interaction. Exploitation likely per Microsoft. Affects Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1/26H2; Windows Server 2016, 2019, 2022, and 2025 (both full and Server Core installations).
What this means
What could happen
A user with standard privileges on a Windows workstation or server could exploit this flaw to gain administrative access, allowing them to modify critical system settings, access sensitive data, or alter control logic on HMI software or engineering workstations used to manage OT equipment.
Who's at risk
Windows IT operators, particularly those managing HMI (Human-Machine Interface) workstations, engineering laptops used for PLC/controller configuration, and Windows-based SCADA servers in water, electric, and other utility environments. Any Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 system exposed to unauthorized local user access is at risk.
How it could be exploited
An attacker with an unprivileged local account runs a specially crafted program that triggers a use-after-free condition in the Win32k kernel subsystem, bypassing access controls and escalating to SYSTEM privileges without requiring administrator credentials or user interaction.
Prerequisites
- Local user account on the affected Windows system
- Ability to execute arbitrary code on the system
- No elevated privileges required at the start
Requires local user accountHigh CVSS score (7.0)Exploitation likely per Microsoft assessmentAffects multiple Windows versions across broad install base
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/2HOTFIXApply the 2026-October Windows security update to all affected systems
HOTFIXPrioritize patching Windows 10 and Server 2019/2022 instances used as HMI workstations or engineering access points for industrial equipment
Long-term hardening
0/2HARDENINGRestrict local login access to Windows systems to authorized personnel only, especially on systems with access to OT networks or control interfaces
HARDENINGImplement application whitelisting on HMI workstations and engineering stations to prevent execution of unauthorized executables that could trigger the exploit
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/afe21840-052d-4050-9eb3-96ddb9914793Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.