OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-96216Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in the Windows kernel allows a local, authenticated user to elevate privileges to system level. An attacker with a standard user account could exploit this flaw to gain complete control of the system. This affects Windows 10 (versions 1809, 21H2, and 22H2), Windows 11 (versions 23H2, 24H2, 25H2, and 26H2), Windows Server 2019, 2022, and 2025. All 32-bit, x64, and ARM64 variants are affected. Microsoft has released fixes for all supported versions as of the October 2026 security update.

What this means
What could happen
A local user with standard privileges could gain full system control by exploiting a memory management flaw in the Windows kernel. On an OT workstation or control station, this could allow an attacker to install malware, alter automation scripts, or intercept communications with field devices.
Who's at risk
IT staff and OT engineers using Windows 10 or Windows 11 workstations, Windows Server-based control stations or data servers, and any engineering laptops that connect to OT networks. Server Core installations are also affected if used as headless automation or monitoring systems.
How it could be exploited
An attacker with a standard user account on a Windows computer must execute specially crafted code that triggers a use-after-free condition in the kernel. The attacker could then run code with system-level privileges, giving them the ability to modify PLC configurations, access sensitive control software, or establish persistence on the engineering workstation.
Prerequisites
  • Standard user account access to the affected Windows system (local login or RDP session)
  • Ability to execute code on the system (e.g., via application vulnerability, malicious attachment, or social engineering)
Local access required (lower immediate risk if network is segmented)Authentication required (standard user account)High CVSS score (7.0)Affects multiple Windows versionsCould lead to full system compromise of engineering workstations
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows 10 Version 21H2 for 32-bit SystemsAll versionsBuild 10.0.19044.7807
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDImplement application whitelisting on engineering workstations to prevent execution of unsigned or unauthorized code
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the October 2026 Windows security update to all Windows 10, Windows 11, and Windows Server systems in your environment
Long-term hardening
0/2
HARDENINGRestrict local login to OT workstations and engineering stations to authorized personnel only; use group policy to limit interactive login rights
HARDENINGRequire multi-factor authentication for remote access (RDP/SSH) to control stations and engineering workstations
View full vendor advisory
API: /api/v1/advisories/6521f103-5cde-4b5d-8933-478723013e97

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows Kernel Elevation of Privilege Vulnerability | CVSS 7 - OTPulse