Windows Kernel Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-70232Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Windows Kernel information disclosure vulnerability allows an authorized local attacker to read sensitive system information that should be restricted. The vulnerability requires local access and existing user credentials to exploit.
What this means
What could happen
A user with login credentials to a Windows system could read kernel memory or system configuration data they should not have access to. This could expose sensitive information but does not allow remote access or direct control of industrial equipment.
Who's at risk
This affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems across all architectures (32-bit, x64, ARM64). It is relevant to operators of utility companies and municipalities who run Windows-based engineering workstations, HMI systems, or domain controllers. Any Windows system with multiple user accounts is at risk.
How it could be exploited
An attacker with a valid local user account on a Windows workstation or server runs a specially crafted application or command that reads protected kernel memory. The attacker gains access to sensitive system information without needing administrator privileges.
Prerequisites
- Valid local user account on the affected Windows system
- Local access to the system (physical or via remote desktop/RDP)
- No administrator privileges required
No authentication required (local user accounts are standard)Low complexityAffects engineering workstations and SCADA servers running Windows
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update to all affected Windows 10, Windows 11, and Windows Server systems
Long-term hardening
0/2HARDENINGRestrict local logon to Windows workstations and servers to authorized personnel only; disable or remove unnecessary local user accounts
WORKAROUNDEnable Windows Defender Application Control (WDAC) or AppLocker on engineering workstations to restrict execution of unauthorized applications
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/8727ffbb-ef5f-4b22-a455-61dd52c08826Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.