Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-83882Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Heap-based buffer overflow in Windows Kernel allows an authorized attacker with local user access to elevate privileges to administrator level. The vulnerability affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (all recent versions), Windows Server 2019, 2022, and 2025. Microsoft has released patches in the October 2026 security update for all affected versions.
What this means
What could happen
A user with standard access to a Windows workstation or server could exploit this kernel vulnerability to gain administrative privileges, allowing them to install malware, modify system configurations, or access sensitive data on that machine.
Who's at risk
Water utilities and electric utilities using Windows 10 or Windows Server 2019/2022/2025 on HMI workstations, engineering stations, or data historians should prioritize this patch. Any system where non-administrative staff operate Windows (control room terminals, asset management PCs, historian servers) is at risk if not updated.
How it could be exploited
An attacker must first gain local user access to the Windows system (through phishing, malware, or social engineering). They then run a specially crafted payload that triggers a heap buffer overflow in the Windows Kernel to escalate privileges from user to administrator without additional authentication.
Prerequisites
- Local user account on the Windows system
- Ability to execute code as a standard user (no admin privileges required)
- Target system running Windows 10 or Windows Server 2019/2022/2025 without the October 2026 security update
locally exploitablelow complexityrequires local user access but no special privilegeshigh CVSS score (7.8)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/8
Schedule — requires maintenance window
0/7Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXUpdate Windows Server 2019 (including Server Core) to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 (including Server Core) to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 (including Server Core) to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 10 Version 1809 (32-bit and x64) to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 21H2 (32-bit, x64, and ARM64) to Build 10.0.19044.7807 or later
HOTFIXUpdate Windows 10 Version 22H2 (32-bit, x64, and ARM64) to Build 10.0.19045.7807 or later
HOTFIXUpdate Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2 to their respective October 2026 builds
Long-term hardening
0/1HARDENINGRestrict local system access to engineering workstations and control room computers to authorized personnel only
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/3899fd8d-123e-4d09-b062-dcf7b259dd59Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.