Windows Kernel-Mode Drivers Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-96247Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A use-of-uninitialized-resource vulnerability in Windows Kernel-Mode Drivers allows an authorized local user to disclose sensitive information from kernel memory. The vulnerability affects Windows 10 (all versions) and Windows Server (2016, 2019, 2022, 2025) on 32-bit, 64-bit, and ARM64 architectures. Exploitation requires an existing user account on the system and cannot be exploited remotely. Microsoft released fixes in the October 2026 security update.
What this means
What could happen
An authorized user on a Windows system could read sensitive information from kernel memory that should not be accessible to them, such as passwords or configuration data. This is a local-only vulnerability with no direct impact on physical operations unless sensitive credentials are disclosed.
Who's at risk
This affects Windows 10 (all versions from 1607 through 26H1) and Windows Server (2016 through 2025). If your HMI (human-machine interface) systems, engineering workstations, historian servers, or OPC servers run on these operating systems, they are affected. The vulnerability requires local access, so only systems with local user accounts that are not fully controlled are at meaningful risk.
How it could be exploited
An attacker with a local user account on a Windows machine could trigger an uninitialized kernel-mode driver resource to leak sensitive data from kernel memory. The attacker must already have logon access to the system; they cannot exploit this remotely.
Prerequisites
- Local user account access to a Windows system
- Ability to execute code on the local machine
- No remote exploitation possible
requires local user access—not remotely exploitablelow exploitation likelihood according to Microsoftcould disclose sensitive credentials or configuration dataaffects all actively supported Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXPrioritize patching Windows Server 2016, 2019, 2022, and 2025 installations first if you run HMIs or engineering workstations
All products
HOTFIXApply the October 2026 Windows security update to your Windows 10 and Windows Server systems
Long-term hardening
0/1HARDENINGRestrict local administrative access on Windows systems running OT applications to only authorized personnel
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/e30fc830-0d2f-4f9a-a31f-28814168a647Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.