OTPulse

Windows Kernel Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-96312Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow in the Windows Kernel allows a user with a local account to escalate privileges to system level. The vulnerability requires the attacker to already have local access but does not require existing administrative credentials. Microsoft has released patches for Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2), and Windows Server (2016, 2019, 2022, 2025). Exploitation is assessed as less likely in the wild at this time.

What this means
What could happen
A user with local access to a Windows machine or server could exploit this kernel flaw to gain system-level privileges, potentially allowing them to modify PLC communications, access sensitive control system configurations, or interfere with HMI and SCADA operations.
Who's at risk
Windows operators and IT staff managing HMI servers, engineering workstations, historian servers, or SCADA network gateways running Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2), Windows Server 2016, 2019, 2022, or 2025. This applies to any Windows-based systems in critical infrastructure networks, especially those connected to PLCs, RTUs, or human-machine interfaces.
How it could be exploited
An attacker with a local user account on a Windows workstation or server can trigger a heap buffer overflow in the kernel through a specially crafted system call or application behavior. Once the overflow is triggered, the attacker gains system privileges without requiring admin credentials beforehand.
Prerequisites
  • Local user account on affected Windows machine
  • Ability to execute code or trigger system calls as a regular user
  • Windows 10/11 or Windows Server 2016/2019/2022/2025
Requires local user accessLow complexity attackHigh impact if successful—attacker gains system privilegesAffects control system infrastructure (Windows servers in ICS networks)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1607 for 32-bit SystemsAll versionsBuild 10.0.14393.9612
Windows 10 Version 1607 for x64-based SystemsAll versionsBuild 10.0.14393.9612
Windows Server 2016All versionsBuild 10.0.14393.9612
Windows Server 2016 (Server Core installation)All versionsBuild 10.0.14393.9612
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/11
Schedule — requires maintenance window
0/9

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 10 Version 1607 to Build 10.0.14393.9612 or later
HOTFIXUpdate Windows 10 Version 1809 to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Version 21H2 to Build 10.0.19044.7807 or later
HOTFIXUpdate Windows 10 Version 22H2 to Build 10.0.19045.7807 or later
HOTFIXUpdate Windows 11 (all versions) to latest available build (23H2: 10.0.22631.7652, 24H2: 10.0.26100.9711, 25H2: 10.0.26200.9711, 26H2: 10.0.26300.9711 or later)
Long-term hardening
0/2
HARDENINGRestrict local user account creation and access on servers hosting HMI, historian, or engineering workstations to trusted personnel only
HARDENINGEnforce multi-factor authentication for remote desktop or SSH access to Windows servers to prevent unauthorized local sessions
View full vendor advisory
API: /api/v1/advisories/c7b2fd39-91f6-4d82-bc9a-86602c4c6e71

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.