Windows TCP/IP Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-83682Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
A use-after-free vulnerability in the Windows TCP/IP stack (CVE-2026-83682) allows a local user to escalate privileges. The flaw is in the TCP/IP driver and can be triggered through crafted network operations. Microsoft has released fixes for all affected Windows 10 and 11 versions and Windows Server 2016, 2019, 2022, and 2025 in the October 2026 security update.
What this means
What could happen
A user with local access to a Windows computer or server running vulnerable versions could exploit a flaw in the TCP/IP stack to run commands with higher privileges, potentially gaining control of critical systems.
Who's at risk
This affects IT staff and OT personnel managing Windows servers and workstations used in control systems environments. Windows 10 (all versions 1607–22H2), Windows 11 (all versions 23H2–26H2), Windows Server 2016, 2019, 2022, and 2025 are vulnerable. Organizations running engineering workstations, HMIs, or data historian servers on Windows are at risk.
How it could be exploited
An attacker with local user credentials on a Windows machine can trigger a use-after-free condition in the TCP/IP driver through crafted network operations, allowing them to execute arbitrary code with system or administrator privileges without requiring additional interaction.
Prerequisites
- Local user account credentials on a Windows 10/11 or Windows Server system
- Ability to execute code or trigger network operations on the affected machine
Requires local user accessAffects multiple Windows versions and Server editionsLow exploit probability (0.3% EPSS)Vendor fix available for all affected versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update to all affected systems (specific build versions listed in the advisory)
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/88af7386-2a6e-4d70-9371-38d91fc2120eGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.