Windows Kernel Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-96317Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows Kernel allows an authorized local attacker to elevate privileges. Affects Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), Windows Server 2019, 2022, and 2025 across 32-bit, x64-based, and ARM64-based systems.
What this means
What could happen
A user with a local login could run kernel-level commands on a Windows system running OT applications, potentially enabling them to modify industrial control software, alter process setpoints, or interfere with supervisory functions running on engineering workstations.
Who's at risk
Windows desktop and server systems running OT applications, engineering workstations, HMI servers, and any Windows-based control system components. Impacts organizations using Windows 10, Windows 11, Windows Server 2019, 2022, or 2025 in industrial automation environments.
How it could be exploited
An attacker must already have local login credentials (e.g., as a standard user). They exploit the use-after-free condition in the Windows Kernel to escalate their privilege level from user to system/kernel level, gaining control over processes and system resources that a normal user cannot access. This could allow modification of OT software or data on the affected machine.
Prerequisites
- Local login credentials required (standard user account or higher)
- Physical or network-based local access to the affected Windows system
- User interaction or active session on the system
Low complexity exploitationLocal attack only (not remotely exploitable)Requires valid user credentials
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/5
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft October 2026 security update to all affected Windows systems
HOTFIXPrioritize patching Windows systems running OT applications and engineering workstations first
Long-term hardening
0/3HARDENINGRestrict local login access to Windows systems to authorized personnel only; disable unnecessary local accounts
HARDENINGImplement multi-factor authentication for local and remote logins where technically feasible
HARDENINGMonitor privileged account activity and failed login attempts on OT-related Windows systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/1e47e65b-8a9b-413c-b342-c7702d3cff7eGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.