Windows Kernel Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-70199Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A Windows Kernel vulnerability allows an authorized local attacker to disclose sensitive system information that should be restricted from user access. The flaw exists in how Windows enforces access controls to kernel memory. Affected versions span Windows 10 (all versions 1607–22H2), Windows 11 (all versions 23H2–26H2), Windows Server 2016, 2019, 2022, and 2025. Microsoft has released fixes for all affected versions in the October 2026 security update.
What this means
What could happen
An attacker with local access to a Windows system could read sensitive kernel memory information that should not be accessible, potentially exposing system secrets or configuration details.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025 systems should update to protect against unauthorized disclosure of sensitive kernel information. This impacts both 32-bit and 64-bit systems across all modern Windows deployments.
How it could be exploited
An attacker with a local user account on the Windows system could execute code that reads protected kernel memory areas through a flaw in how Windows restricts access to kernel information. This requires the attacker to already have interactive access to the system.
Prerequisites
- Local user account or higher on the Windows system
- Ability to execute code on the target machine
Low attack complexityRequires local access (not remotely exploitable)Information disclosure only (no code execution or denial of service)
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update for your Windows OS version and architecture
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/97e6d09d-196b-4f87-93f2-7537b4358c1aGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.