Windows Kernel Vulnerability Allows Attackers to Modify Kernel Memory Counters

Cybersecuritynews •Abinaya • May 27, 2026

A critical Windows kernel vulnerability, tracked as CVE-2026-40369, has been disclosed, enabling attackers to achieve full SYSTEM-level privilege escalation even from the most restricted environments, including browser sandboxes. Discovered by security researcher Ori Nimron, the flaw affects Windows 11 versions 24H2 through 25H2 and resides in the ntoskrnl.exe component, specifically within the ExpGetProcessInformation function. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Windows Kernel Vulnerability Enables SYSTEM Privilege Escalation A critical vulnerability in the Windows kernel, identified as CVE-2026-40369, has been disclosed, allowing unprivileged processes to escalate privileges to SYSTEM level. This flaw affects Windows 11 versions 24H2 through 25H2 and resides in the ntoskrnl.exe component, specifically within the ExpGetProcessInformation function. Attackers can exploit this vulnerability from restricted environments, such as browser sandboxes, using a single NtQuerySystemInformation call. The vulnerability was published on May 12, 2026, with a proof of concept (PoC) made public shortly after on May 14, 2026. Security researchers have emphasized the potential for widespread exploitation given the ease of access to the attack vector. Organizations using affected Windows versions are urged to apply security updates as soon as they are available. 2 sources 69

Extracted Entities

Windows Kernel Vulnerability Allows Attackers to Modify Kernel Memory Counters

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)