OTPulse

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

MonitorCVSS 6.8CVE-2026-83573Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorPhysical
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Integer overflow or wraparound in Windows Kernel Mode Driver allows privilege escalation on affected Windows systems. This affects Windows Server 2016, 2019, 2022, 2025 and Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2) across all processor architectures. Exploitation requires physical access to the system.

What this means
What could happen
An attacker with physical access to a Windows system can run commands with system-level privileges, potentially allowing them to modify settings, access sensitive data, or disrupt operations on devices running the affected systems.
Who's at risk
Windows Server operators (2016, 2019, 2022, 2025) and Windows 10/11 users, particularly those running engineering workstations, HMI systems, or data historian servers in water utilities and electric systems. All processor architectures are affected (x64, 32-bit, ARM64).
How it could be exploited
An attacker with physical access to a Windows system can exploit an integer overflow in the kernel-mode driver to escalate privileges from user mode to system mode without needing valid credentials.
Prerequisites
  • Physical access to the Windows device
  • Ability to execute code or interact with the kernel driver locally
Affects safety-critical systems if running on control workstationsRequires physical access (lower risk in secured data centers)Kernel-level access potential
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXPrioritize patching Windows Server 2019, Server 2022, and Windows 11 systems in your SCADA/HMI environment
All products
HOTFIXApply the October 2026 Microsoft security update to all affected Windows Server and Windows 10/11 systems
Long-term hardening
0/1
HARDENINGRestrict physical access to engineering workstations and control system servers through badge access, locked server rooms, or secure enclosures
View full vendor advisory
API: /api/v1/advisories/1c787b34-0ab6-4a3c-a569-c8a13a749067

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.