OTPulse

Windows Server Update Service Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-81969Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A flaw in Windows Server Update Service (WSUS) allows insufficient access control granularity, enabling an authorized local user to escalate privileges to administrator level. The vulnerability affects Windows Server 2016, 2019, 2022, 2025 and Windows 10 versions 1607 and 1809 across 32-bit and x64 architectures. Exploitation requires local access and is assessed as less likely in practice.

What this means
What could happen
An attacker with local access to a Windows server could escalate their privileges to administrator level, allowing them to modify system configurations, access sensitive data, or interrupt critical operations.
Who's at risk
Windows server operators running Windows Server 2016, 2019, 2022, or 2025 (including Server Core installations) should prioritize patching. Also affects Windows 10 systems running versions 1607 and 1809. This affects any organization using these systems for SCADA infrastructure, historian servers, engineering workstations, or IT infrastructure supporting OT environments.
How it could be exploited
An attacker with a standard user account on the server exploits weak access controls in Windows Server Update Service (WSUS) to elevate privileges to administrator without additional authentication or interaction.
Prerequisites
  • Local user account on the Windows server
  • Physical access or Remote Desktop/console access to the server
Local exploitation onlyRequires valid local user accountAffects multiple Windows versionsPrivilege escalation to administrator
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5761
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Windows Server 2025All versionsBuild 10.0.26100.33650
Remediation & Mitigation
0/8
Schedule — requires maintenance window
0/7

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
All products
HOTFIXUpdate Windows 10 Version 1809 (32-bit) to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 1809 (x64) to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 1607 (32-bit and x64) to Build 10.0.14393.9612 or later
Long-term hardening
0/1
HARDENINGRestrict local user account creation and access on critical servers; audit accounts with local access
View full vendor advisory
API: /api/v1/advisories/515b7e79-926f-4406-8022-3dde5b1bef92

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.