OTPulse

Windows Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-70249Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

Use-after-free vulnerability in Windows Win32 Kernel Subsystem allows an authorized local attacker to elevate privileges. Affects Windows 10 (all versions 1607–22H2), Windows 11 (all versions 23H2–26H2), Windows Server 2016, 2019, 2022, and 2025.

What this means
What could happen
A logged-in user could exploit this to gain system-level privileges, potentially allowing control of critical processes, configuration changes, or interference with engineering workstations and HMI systems in water or electrical utilities.
Who's at risk
This affects all staff computers, engineering workstations, HMI servers, and IT infrastructure running Windows 10 (versions 1607–22H2), Windows 11 (versions 23H2–26H2), Windows Server 2016/2019/2022/2025 environments. Primary concern is compromise of engineer workstations used to configure PLCs and RTUs, or servers hosting SCADA software.
How it could be exploited
An authenticated local user runs malicious code that triggers a use-after-free condition in the Win32 kernel subsystem, allowing privilege escalation from user to system level. This requires code execution on the target system but no remote network access.
Prerequisites
  • Authenticated local user account on affected Windows system
  • Ability to execute code on the target system
  • No network access required
Low complexityLocal only (not remotely exploitable from network)Authentication requiredExploitation more likely (active research or in-the-wild cases)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDMonitor systems for suspicious privilege escalation attempts in Windows Event Logs (Security > Privilege Use events)
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the October 2026 Windows security update to all affected systems
HOTFIXPrioritize updates for engineering workstations and HMI/SCADA servers before general IT infrastructure
Long-term hardening
0/1
HARDENINGRestrict local system access and enforce principle of least privilege—disable unnecessary local user accounts and enforce strong password/credential policies
View full vendor advisory
API: /api/v1/advisories/6ec2d55c-ce47-4f7f-81e4-4247065e5e5b

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.