Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-83735Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Invalid pointer or reference in the Windows Kernel allows a local authorized user to elevate privileges and gain system-level access. Exploitation is assessed as more likely. Affects Windows Server 2025 (all versions) and Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2) on both x64 and ARM64 architectures.
What this means
What could happen
A user with local access to a Windows server or workstation could exploit this kernel flaw to run commands with system-level privileges, potentially allowing them to modify automation software, disable monitoring, or alter system configurations critical to facility operations.
Who's at risk
Windows administrators managing Windows Server 2025 and Windows 11 (all versions 23H2 through 26H2) in utility and water authority environments. This affects engineering workstations running Windows 11, SCADA historian servers, HMI systems, and data collection servers if they run any of these affected Windows versions.
How it could be exploited
An attacker with a standard user account on the machine could trigger the invalid pointer in the Windows Kernel, causing it to execute code with administrator privileges. No network access is required; the attacker must already have local login access to the device.
Prerequisites
- Local user account on the affected Windows Server or Windows 11 system
- User does not require administrative credentials to trigger the vulnerability
Locally exploitableLow attack complexityLow CVSS score but kernel-level impactExploitation more likely per vendor assessment
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/8
Schedule — requires maintenance window
0/6Patching may require device reboot — plan for process interruption
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later via Windows Update
All products
HOTFIXUpdate Windows 11 23H2 systems to Build 10.0.22631.7652 or later
HOTFIXUpdate Windows 11 24H2 systems to Build 10.0.26100.9711 or later
HOTFIXUpdate Windows 11 25H2 systems to Build 10.0.26200.9711 or later
HOTFIXUpdate Windows 11 26H1 systems to Build 10.0.28000.3231 or later
HOTFIXUpdate Windows 11 26H2 systems to Build 10.0.26300.9711 or later
Long-term hardening
0/2HARDENINGRestrict local console and RDP access to authorized personnel only; disable unnecessary local accounts on engineering and SCADA workstations
HARDENINGImplement application whitelisting and disable PowerShell remoting on engineering workstations to limit the impact of privilege escalation
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/62f6f2d8-d271-4f1b-9438-a28c0d5c5995Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.