OTPulse

Windows Kerberos Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-83720Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in Windows Kerberos allows an authorized local user to escalate privileges. The vulnerability exists in Windows 11 version 26H1 for both x64 and ARM64 systems. Microsoft has released a fix in the October 2026 security update (Build 10.0.28000.3231). Exploitation is assessed as less likely.

What this means
What could happen
An attacker with local user account access could exploit a memory flaw in Windows Kerberos to gain elevated privileges and take full control of the system, potentially affecting HMI workstations, historian servers, or engineering terminals connected to your operational network.
Who's at risk
This affects IT and OT personnel using Windows 11 systems, including HMI operator workstations, engineering terminals, historian servers, and remote desktop jump hosts that interact with industrial control systems. Any Windows 11 device on your operational network that is used to access or manage plant equipment is at risk.
How it could be exploited
An attacker with an active local user account on a Windows 11 system could trigger a use-after-free condition in the Kerberos authentication handler to escalate from standard user privileges to administrative privileges, allowing them to run arbitrary commands or modify system settings.
Prerequisites
  • Valid local user account on affected Windows 11 system
  • Local network access to the system
  • Active Kerberos authentication in use
Local privilege escalationRequires valid user account (insider or compromised account)Low exploitation likelihoodAffects workstations with OT access
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Windows 11 version 26H1 for x64-based SystemsAll versionsBuild 10.0.28000.3231
Windows 11 Version 26H1 for ARM64-based SystemsAll versionsBuild 10.0.28000.3231
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Windows 11 security updates for October 2026 (Build 10.0.28000.3231 or later) via Windows Update or WSUS
View full vendor advisory
API: /api/v1/advisories/834751fd-32f3-4467-b6c2-4d930dabb373

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.