OTPulse

Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-83637Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in Windows kernel-mode drivers allows an authenticated local user to elevate privileges to system level. This affects Windows 10 versions 1607, 1809, 21H2, 22H2, and 23H2 across 32-bit, x64, and ARM64 architectures, as well as Windows Server 2016, 2019, 2022, and 2025 in both full and Server Core installations. Microsoft has released security updates for all affected versions.

What this means
What could happen
An attacker with a local user account on a Windows system can exploit a kernel driver flaw to gain system-level privileges, potentially allowing them to modify control logic, disable safety interlocks, or shut down critical operations.
Who's at risk
Water utilities and municipal electric utilities running Windows 10 or Windows Server 2016 or later should evaluate this risk, particularly on systems hosting supervisory control interfaces, historian servers, engineering workstations, or data aggregation nodes. Systems running Windows Server Core on critical OT network segments are especially relevant.
How it could be exploited
An attacker with a standard user account runs a malicious application that triggers an out-of-bounds read in a Windows kernel-mode driver. The vulnerability allows privilege escalation from user-level to system-level, granting full control over the operating system and any industrial processes running on it.
Prerequisites
  • Local user account credentials on a Windows system
  • Ability to execute applications on the target machine
  • No requirement for administrator privileges to initiate the exploit
Privilege escalation from user to systemLocal access required but no prior elevated privileges neededAffects multiple Windows versions across server and client platformsWide deployment footprint in utility IT/OT environments
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (20)
20 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/8
Do now
0/1
HARDENINGRestrict local interactive logon access to critical OT systems to authorized operators only via Group Policy or OS-level access controls
Schedule — requires maintenance window
0/7

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 10 Version 1809 to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 21H2 to Build 10.0.19044.7807 or later
HOTFIXUpdate Windows 10 Version 22H2 to Build 10.0.19045.7807 or later
View full vendor advisory
API: /api/v1/advisories/e35811ee-87fd-4432-a5c4-5185001093e1

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.