Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-88141Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
A use-after-free vulnerability in the Windows Kernel allows a local user with valid credentials to elevate their privileges to system level. The flaw affects Windows Server 2022, Windows Server 2025, and Windows 11 (versions 23H2, 24H2, 25H2, and later). Exploitation is unlikely based on current threat intelligence, but the vulnerability should be patched through the October 2026 security update when maintenance windows are available.
What this means
What could happen
A local user with valid credentials could exploit a memory flaw in the Windows Kernel to gain system-level privileges, potentially allowing them to modify critical system settings, access sensitive data, or install malicious software on the device.
Who's at risk
Organizations running Windows Server 2022 or 2025, and Windows 11 systems (all current versions) should prioritize patching these devices, particularly those used for control system engineering workstations, HMI systems, or historian servers that run on Windows infrastructure. SCADA and ICS environments using Windows-based supervisory systems are affected.
How it could be exploited
An attacker with a standard user account on a Windows Server or Windows 11 system could trigger a use-after-free condition in the kernel to escalate their privileges to system level. This requires local access and valid credentials; the attacker cannot exploit this remotely over the network.
Prerequisites
- Valid user account credentials on the affected Windows system
- Local access to the Windows Server or Windows 11 device
- No network-based exploitation possible
local privilege escalationrequires valid credentialsmedium attack complexityno active exploitation reportedlow exploit probability (0.3% EPSS)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (14)
14 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/7
Schedule — requires maintenance window
0/5Patching may require device reboot — plan for process interruption
Windows Server 2022
HOTFIXApply Microsoft October 2026 security update to Windows Server 2022 (Build 10.0.20348.5761 or later)
Windows Server 2025
HOTFIXApply Microsoft October 2026 security update to Windows Server 2025 (Build 10.0.26100.33650 or later)
All products
HOTFIXApply Microsoft October 2026 security update to Windows 11 Version 23H2 systems (Build 10.0.22631.7652 or later)
HOTFIXApply Microsoft October 2026 security update to Windows 11 Version 24H2 systems (Build 10.0.26100.9711 or later)
HOTFIXApply Microsoft October 2026 security update to Windows 11 Version 25H2 systems (Build 10.0.26200.9711 or later)
Long-term hardening
0/2HARDENINGRestrict local user access to critical Windows servers to authorized staff only
HARDENINGImplement multi-factor authentication (MFA) for administrative accounts to reduce credential compromise risk
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/41a41980-21c2-4087-8dfc-7a3784c418ccGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.