OTPulse

Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-83732Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A use-after-free vulnerability in Windows Win32k kernel component allows an authorized local user to elevate their privileges to System level. The vulnerability affects Windows 10 (all versions 1607–22H2), Windows 11 (all versions 23H2–26H2), Windows Server 2016, 2019, 2022, and 2025. Microsoft rates exploitation as more likely and recommends immediate patching via the October 2026 security update.

What this means
What could happen
A user with local access to a Windows workstation or server could exploit this flaw to gain administrator privileges, potentially allowing them to modify system settings, access sensitive files, or manipulate critical processes running on that machine.
Who's at risk
Windows administrators and operators running any version of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 should prioritize patching. This affects workstations used to manage industrial systems, engineering PCs, HMI servers, and any Windows-based control system infrastructure where local user access is present.
How it could be exploited
An attacker with a local user account executes a specially crafted program that triggers a use-after-free condition in the Win32k kernel component. If successful, the attacker gains System-level privileges and can then run any command with elevated permissions.
Prerequisites
  • Local user account on the affected Windows system
  • Ability to execute arbitrary programs on the target system
Low complexity exploitationRequires local account (not remotely exploitable)Affects all Windows versions from 2016 onwardHigh CVSS score (7.8)Exploitation more likely per vendor assessment
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/3
Do now
0/1
HARDENINGRestrict local logon privileges to trusted users only and remove unnecessary local accounts
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXInstall the October 2026 Windows security update for your system version
Long-term hardening
0/1
HARDENINGEnforce application whitelisting to prevent unauthorized program execution
View full vendor advisory
API: /api/v1/advisories/6d36845e-aec9-44d0-a1a2-73dc97b5989b

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Win32k Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse