OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-85360Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

Use-after-free vulnerability in Windows Kernel. An authorized attacker with local access and valid credentials can exploit this flaw to elevate privileges from regular user to system administrator level on Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems (all versions and architectures affected). Microsoft released fixes in the September 2026 security update.

What this means
What could happen
An attacker with local access to a Windows machine running a vulnerable version could gain system-level privileges, potentially allowing them to take full control of the device or any control systems running on it.
Who's at risk
Any organization running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 across the enterprise is affected. This is particularly important for engineering workstations, SCADA/HMI servers, data historians, and any Windows-based control or monitoring systems in your utility operations. Both 32-bit and 64-bit systems are vulnerable.
How it could be exploited
An attacker with an existing user account on the Windows machine would run a specially crafted program that exploits a use-after-free flaw in the Windows kernel. This would allow the attacker to escalate from regular user privileges to system (administrator) privileges on the local machine.
Prerequisites
  • Valid user account on the target Windows system
  • Local access to the Windows machine (physical or remote desktop session)
  • Ability to run arbitrary code as the local user
Requires local accessRequires valid user credentialsHigh complexity exploitLow EPSS score (0.2%)Affects all common Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Microsoft September 2026 security update to Windows 10/11/Server systems. Update to the specified build number for your Windows version (e.g., Build 10.0.19045.7725 for Windows 10 Version 22H2).
Long-term hardening
0/2
HARDENINGRestrict local login privileges on critical control system machines to only necessary operational staff. Disable unnecessary remote desktop or terminal access on devices running control software.
HARDENINGReview and audit user account privileges on all Windows systems, especially engineering workstations and OT-connected servers. Remove unnecessary administrative access for standard users.
View full vendor advisory
API: /api/v1/advisories/162a011e-144f-4791-bcfb-6e8fa04ff143

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.