OTPulse

Windows TCP/IP Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-83678Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow in the Windows TCP/IP stack allows a local user to escalate privileges to system level. The vulnerability requires local access but no elevated privileges to exploit. Microsoft has released patches for all affected Windows versions in the October 2026 security update.

What this means
What could happen
A user with local access to a Windows computer or server could run malicious code with system-level privileges, potentially compromising the entire machine and any connected OT network. In a plant environment, this could allow an attacker to modify process controls or shut down critical systems.
Who's at risk
Organizations running Windows 10, Windows 11, or Windows Server (2016, 2019, 2022, 2025) should prioritize this if these systems are used as engineering workstations, data historians, SCADA servers, or HMI platforms in industrial facilities. Any Windows machine that can reach your OT network is a potential attack path.
How it could be exploited
An attacker with a local user account on a Windows machine exploits a heap buffer overflow in the TCP/IP stack by sending specially crafted network packets or via local API calls, escalating from user-level to system-level privileges without needing admin credentials initially.
Prerequisites
  • Local user account on the affected Windows system
  • No elevated privileges required to trigger the vulnerability
Local exploitation requiredLow complexity attackHigh CVSS score (7.8)Affects confidentiality, integrity, and availability
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXPrioritize patching Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems that support critical OT infrastructure
All products
HOTFIXApply the October 2026 Windows security update to all affected Windows 10, Windows 11, and Windows Server systems
Long-term hardening
0/1
HARDENINGRestrict local user access on Windows systems that interface with or support industrial control systems to only authorized personnel
View full vendor advisory
API: /api/v1/advisories/0c6205fa-8645-4c18-b325-dfa246ebefa5

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.