Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-83568Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Improper access control in Windows Kernel-Mode Drivers allows a user with a local account to escalate privileges to administrator level on affected Windows 11 and Windows Server 2025 systems. This kernel-mode vulnerability bypasses normal permission restrictions and could allow unauthorized modification of system configurations or installation of persistent malware on critical infrastructure workstations.
What this means
What could happen
A user with local access to a Windows system could exploit this vulnerability to gain administrator-level privileges, potentially allowing them to install malware, modify critical system settings, or disrupt operations on SCADA/HMI servers.
Who's at risk
Organizations running SCADA, HMI, or engineering workstations on Windows 11 (versions 24H2, 25H2, 26H1, or 26H2) or Windows Server 2025 should evaluate their exposure. This affects both ARM64 and x64 systems used in water utilities, electric utilities, and critical infrastructure environments that depend on Windows-based control interfaces.
How it could be exploited
An attacker with a local user account on an affected Windows system (such as a SCADA workstation or HMI server) could execute a specially crafted kernel-mode driver that exploits improper access control to escalate privileges to administrator level without requiring additional interaction from the user.
Prerequisites
- Local user account on the affected Windows system
- Ability to execute code or load a driver on the local system
Local privilege escalationRequires local user accountLow complexity attackAffects Windows-based control systems
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/10
Schedule — requires maintenance window
0/9Patching may require device reboot — plan for process interruption
Windows Server 2025
HOTFIXUpdate Windows Server 2025 (all installations) to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 11 26H2 ARM64 systems to Build 10.0.26300.9711 or later
HOTFIXUpdate Windows 11 26H2 x64 systems to Build 10.0.26300.9711 or later
HOTFIXUpdate Windows 11 25H2 ARM64 systems to Build 10.0.26200.9711 or later
HOTFIXUpdate Windows 11 25H2 x64 systems to Build 10.0.26200.9711 or later
HOTFIXUpdate Windows 11 24H2 ARM64 systems to Build 10.0.26100.9711 or later
HOTFIXUpdate Windows 11 24H2 x64 systems to Build 10.0.26100.9711 or later
HOTFIXUpdate Windows 11 26H1 ARM64 systems to Build 10.0.28000.3231 or later
HOTFIXUpdate Windows 11 26H1 x64 systems to Build 10.0.28000.3231 or later
Long-term hardening
0/1HARDENINGRestrict local user access on SCADA workstations and HMI servers to authorized personnel only
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/475413d5-f31c-4d9c-94bb-c841822ed1e4Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.