Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-83690Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A use-after-free vulnerability in the Windows kernel allows a user with a local account to elevate their privileges to administrator level. The flaw affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2019, 2022, and 2025, across both 32-bit and 64-bit architectures. Exploitation is considered unlikely, but if triggered, it grants full system control to an attacker with local access.
What this means
What could happen
A user with a local login account could exploit this Windows kernel flaw to gain administrator-level control of the system, potentially allowing them to modify engineering workstations, HMIs, or historian servers in your ICS environment.
Who's at risk
IT and OT staff managing Windows-based engineering workstations, SCADA servers, HMI (Human Machine Interface) systems, historians, and any other ICS-connected Windows 10, Windows 11, or Windows Server machines. Affects both 32-bit and 64-bit systems across Server 2019, 2022, 2025, and multiple Windows 10/11 versions.
How it could be exploited
An attacker with a local user account on a Windows workstation or server can trigger a use-after-free condition in the kernel to escalate their privileges to administrator level, gaining full control of the machine and any processes running on it.
Prerequisites
- Local user account on the affected Windows system
- Ability to execute code on the machine (no remote exploitation)
low complexity exploitationrequires local user account accessaffects ICS engineering and IT infrastructurepatch available from vendor
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict physical or remote desktop access to affected systems to authorized personnel only
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update (or later) to all affected Windows 10, Windows 11, and Windows Server systems
HOTFIXPrioritize patching any engineering workstations, HMI servers, or historian systems running affected Windows versions
Long-term hardening
0/1HARDENINGReview and enforce local account policies to disable or remove unnecessary local user accounts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/cc94b0c9-9d65-4ce9-bdf5-1d41bdb27ff7Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.