Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-83942Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Missing authorization check in the Windows Kernel allows a user with a local account to elevate privileges to system/administrator level. The vulnerability affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, and 2025 across 32-bit, x64, and ARM64 architectures. Microsoft has released fixes in the September 2026 security update, and exploitation is considered less likely in the wild.
What this means
What could happen
A user with a local account on a Windows workstation or server could exploit this kernel vulnerability to gain administrative privileges, potentially allowing them to modify critical control software, alter system configurations, or disable security monitoring on OT systems.
Who's at risk
Water utilities, electric utilities, and other critical infrastructure operators running Windows workstations, HMI systems, or engineering PCs (Windows 10, Windows 11, Windows Server 2019, 2022, or 2025). This affects any user-accessible systems where engineering staff, operators, or technicians log in with non-administrative accounts.
How it could be exploited
An attacker with a regular user account on the machine (for example, a standard domain user or HMI operator account) can execute a specially crafted application that exploits the kernel flaw to escalate to system/administrator level. This could be delivered via email attachment, USB drive, or compromised software update in an air-gapped or corporate network scenario.
Prerequisites
- Valid user account on the Windows system (local or domain account)
- Ability to execute code or run an application on the target machine
- No special network access required—exploitation is local only
Remotely exploitable if attacker gains initial user account accessLow complexity to exploit once on the systemNo authentication required beyond having a user accountCould affect safety-critical HMI or SCADA workstations if not patched
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (22)
22 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXInstall the September 2026 security update for your Windows version (Build 10.0.17763.9245 for Windows Server 2019, Build 10.0.20348.5622 for Windows Server 2022, Build 10.0.26100.33438 for Windows Server 2025, or the corresponding build for Windows 10/11 versions in your environment)
Long-term hardening
0/3HARDENINGRestrict local administrator account creation and use—ensure only necessary service accounts and administrators have elevated privileges
HARDENINGEnforce application whitelisting on critical workstations and HMI/engineering systems to block unauthorized executables
HARDENINGImplement endpoint detection and response (EDR) or host-based intrusion detection to monitor for suspicious privilege escalation attempts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/7ac5c721-f59f-4dc0-93b3-2de018390076Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.