Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-83768Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. An attacker with user-level access can exploit this to gain system-level (kernel) privileges on affected Windows 10, Windows 11, and Windows Server systems.
What this means
What could happen
A user with local access to a Windows system could gain full administrative control, allowing them to modify any data, install malware, or disrupt operations on that machine. This could affect any HMI, engineering workstation, or server running Windows in your operational network.
Who's at risk
Any operator or engineer with a Windows workstation, HMI, server, or automated system running Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), or Windows Server (2019, 2022, 2025) in any configuration. This includes 32-bit, 64-bit (x64), and ARM64 systems.
How it could be exploited
An attacker with a user account on a Windows machine can run a specially crafted program that exploits a heap buffer overflow in the kernel to execute code with system privileges. Once kernel access is gained, the attacker has full control of the machine and can access or modify any files, processes, or network communications.
Prerequisites
- Local user account on the Windows system
- Ability to execute programs or scripts on the affected machine
Locally exploitableLow complexity attackAffects all Windows 10 and 11 versionsAffects Windows Server systems used for SCADA/HMI infrastructureExploitation is assessed as more likely
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update to all affected Windows 10, Windows 11, and Windows Server systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/86a03cf5-5e7d-47e4-bf85-ef90a2700f33Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.