Win32k Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-70292Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds read vulnerability in the Windows Win32 Kernel Subsystem allows an authorized local attacker to disclose kernel memory information. The vulnerability requires local access and valid credentials. Microsoft has released patches for all supported Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 versions in the October 2026 security update.
What this means
What could happen
An attacker with local access to an engineering workstation or HMI could read sensitive kernel memory, potentially exposing credentials, configuration data, or process information that could be used for further attacks on the OT network.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 on engineering workstations, historian servers, HMI systems, or other administrative computers connected to the OT network should apply this patch. This is most critical for any Windows system used for process control, telemetry collection, or direct interaction with PLCs, RTUs, or other field devices.
How it could be exploited
An attacker with local user or service account privileges exploits an out-of-bounds read in the Win32k kernel subsystem to access kernel memory regions. The attacker must already have local code execution capability or valid local credentials to trigger the vulnerability.
Prerequisites
- Local access to the affected Windows system (user or service account credentials)
- Ability to execute code or run a malicious application on the affected system
- Local user privilege level or higher
Low complexity attackRequires local access/authenticationInformation disclosure only (no direct operational impact)Affects all modern Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict local administrative access on engineering workstations and HMI systems to only authorized personnel
Schedule — requires maintenance window
0/3Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft October 2026 security updates to all affected Windows systems (Windows 10, 11, Server 2016, 2019, 2022, 2025)
HARDENINGDisable unnecessary local services on OT-connected systems that do not require Win32k subsystem access
HARDENINGMonitor for suspicious local process execution or kernel memory access attempts on OT systems using endpoint detection
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/052701c6-8bfd-444f-abb8-a695961dd2f3Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.