Windows Win32k Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-70253Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows Win32 Kernel Subsystem allows an authorized local attacker to elevate privileges. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 across multiple architecture versions (32-bit, x64, ARM64).
What this means
What could happen
An attacker with local access could run arbitrary commands with elevated privileges on Windows systems, potentially compromising HMI workstations, engineering stations, or servers that support industrial operations. This could enable unauthorized modification of control system settings, data theft, or disruption of plant operations.
Who's at risk
This affects organizations running Windows on any device that supports plant operations: HMI (Human-Machine Interface) workstations, engineering stations, data historians, OPC servers, and Windows-based controllers or gateways. Any IT staff or contractors with local access to these systems pose a risk if they have not been vetted.
How it could be exploited
An attacker with a local user account on a Windows system can exploit the Win32 Kernel Subsystem use-after-free condition to escalate their privileges to system level without additional authentication. The attack does not require user interaction. Once elevated, the attacker can execute commands with full system privileges.
Prerequisites
- Local user account on the affected Windows system
- No elevated privileges required at start of exploitation
Requires local access onlyLow complexity exploitationAffects confidentiality, integrity, and availabilityVendor patches available for all affected products
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1HARDENINGRestrict local interactive logon access to Windows systems to authorized personnel only
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply October 2026 Windows security updates to all affected systems (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, 2025)
All products
HOTFIXPrioritize patching engineering workstations, HMI servers, and any Windows systems with direct access to control networks
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/4e361f2a-e026-4da9-beb6-bf3a67ce124fGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.