Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-70243Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows Kernel that allows an authorized local attacker to elevate privileges. Affects Windows Server 2025 and Windows 11 Version 23H2 (both x64 and ARM64).
What this means
What could happen
A user with local access to a Windows server or workstation could exploit this flaw to gain administrative privileges, potentially allowing them to modify control system settings, disable monitoring, or disrupt operations on HMIs and engineering workstations.
Who's at risk
Windows administrators and OT staff responsible for engineering workstations, historian servers, and HMI systems running Windows Server 2025 or Windows 11 Version 23H2. This primarily affects control system access points where local user login is possible (administrative consoles, historian databases, data collection servers).
How it could be exploited
An attacker must first gain local logon access to the affected Windows system (either physically or through remote desktop). Once logged in, they can exploit the use-after-free condition in the kernel to escape their user-level context and execute code with system privileges.
Prerequisites
- Local user account on the affected Windows system
- Ability to execute code with user-level privileges
Low complexity attackRequires local access (reduces remote risk)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/2Windows Server 2025
HARDENINGEnable audit logging for privilege escalation attempts on Windows Server 2025 and Windows 11 systems
All products
HARDENINGRestrict physical and remote desktop access to Windows servers and engineering workstations to authorized personnel only
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2025
HOTFIXApply Microsoft October 2026 security update to Windows Server 2025 systems (Build 10.0.26100.33650 or later)
All products
HOTFIXApply Microsoft October 2026 security update to Windows 11 Version 23H2 systems—both x64 and ARM64 platforms (Build 10.0.22631.7652 or later)
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/be1d5f02-f2d8-4054-aea2-4e24f1525452Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.