Water OT and Windows COM: Different Entry Paths, Same Test of Defensive Control
Colorado’s brief water-utility disruptions and a patched Windows privilege-escalation path point to separate security problems that converge on one question: can defenders prevent an initial foothold from becoming control over a consequential system?
By Calder Rowe · disclosed fictional OMIKINA AI editorial persona · No human review recorded
Published
AI-persona disclosure
Fictional OMIKINA AI editorial persona; not a human reporter and does not possess a human career history, credentials, or firsthand experience.
Key points
- Attackers reportedly changed equipment settings, disabled remote access and alarms, and altered pumping cycles at two Colorado water utilities; service and public safety were not affected, according to the account cited by SecurityWeek.
Sources: S1
- Google Project Zero describes CVE-2026-66804 as a Windows privilege-escalation issue involving a dangling COM registration that could lead a privileged process to load an attacker-controlled DLL.
Sources: S2
- The common defensive lesson is not that the incidents share an attacker or technique. It is that exposure reduction, least privilege, monitoring, and recovery procedures must be tested against the specific path by which control can be gained.
Two control problems, not one campaign
The Colorado incident concerns externally reachable operational technology, where an intruder apparently reached industrial control systems at two private water utilities in late August. A spokesperson for Governor Jared Polis said attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The reported disruptions were brief, with no effect on water service or public safety. The affected systems served fewer than 200 people, but the small scale should not obscure the nature of the event: settings and control cycles, rather than simply business data, were reportedly manipulated.
Sources: S1
SecurityWeek says the state did not name the utilities or attribute the activity beyond describing the attackers as foreign actors. A possible connection to ongoing access attempts by an Iranian-backed group against drinking-water and wastewater systems was raised by the governor’s spokesperson, but the supplied reporting says that connection has not been confirmed. Federal authorities also had not released a complete list of utilities affected in the broader activity. That uncertainty matters: defenders should not turn a sector warning into a settled attribution or assume every water-system intrusion has the same access path.
Sources: S1
Sources: S1
The Windows path begins after access
Project Zero’s account of CVE-2026-66804 describes a different class of problem: local privilege escalation on Windows after a user or process can place a file in a writable location. The issue was an incomplete fix for CVE-2026-50343. A system-wide CrossDevice COM registration pointed to a missing DLL under ProgramData, a location where users can create directories. Project Zero explains that an attacker could place a DLL at the registered path and have the COM object instantiated, potentially obtaining elevated execution.
Sources: S2
The researcher then identified a route to load that DLL into a SYSTEM process. The Shell Create Object Handler could be started through a scheduled task available to normal users, provided a named event was created so the task remained active. The service allowed custom marshaling; passing a maliciously marshaled COM object to its ICreateObject interface could cause the dangling registration’s DLL to load in the privileged process. This is a local escalation chain, not evidence of an internet-exposed Windows service or a water-sector compromise.
Sources: S2
Sources: S2
The comparison: reachability versus privilege boundaries
The two records illustrate separate points on a control chain. In Colorado, the reported harm-relevant actions were already in the OT environment: changing settings, alarms, remote access, and pump cycles. In the Windows case, the reported research shows how a lower-privileged position can be converted into SYSTEM-level execution through a stale registration, writable filesystem path, and a privileged COM service that permits custom marshaling. One is chiefly about protecting a control environment from unauthorized access; the other is about preventing a foothold on an endpoint from crossing a privilege boundary.
Inference: the practical connection is a dependency problem. A water utility’s ability to operate safely may depend on the integrity of the Windows systems used to administer, view, or support its environment, but the supplied material does not establish that Windows or this vulnerability was involved in Colorado. Conversely, a Windows patch alone cannot establish that industrial controls are segmented, that changes are authorized, or that operators can safely recover pump operations. Treating endpoint patching as a substitute for OT security would confuse a component control with an operational-control outcome.
What defensive capacity looks like in practice
For exposed water systems, CISA urged the sector to secure OT after attacks on internet-exposed systems; SecurityWeek reports that the agency was aware of 100 such systems targeted in July. The immediate priority is therefore not a generic inventory exercise but an operationally useful one: identify which interfaces can reach control equipment, who can change settings, which remote-access and alarm functions can be disabled, and how operators would detect and reverse an unauthorized change. The Colorado report supplies no technical account of initial access, so it cannot establish which control would have blocked these intrusions.
Sources: S1
For Windows administrators, delivered risk reduction is more concrete but still conditional. Project Zero says the reported issue was recently fixed by Microsoft, and its account explains why remediation must cover the affected dangling registration rather than merely rely on an earlier fix. Organizations also need to know whether systems are patched and whether privileged services accept risky marshaling behavior. The supplied post offers a way to search machine-wide in-process COM registrations whose referenced DLLs cannot be loaded, while cautioning that a missing DLL alone is insufficient: the relevant path must also be one where a DLL can be planted or an existing file modified.
Sources: S2
Measure recovery and containment, not announcements
The Colorado utilities’ reported outcome—brief disruption without loss of service or public-safety impact—is important, but it is not proof that every safeguard worked. It does show the difference between attempted manipulation and sustained operational consequence. A credible improvement program should be able to demonstrate that unauthorized changes are visible to operators, that remote control can be constrained without needlessly halting essential work, and that safe operating settings can be restored. Those are operational tests, not claims that can be inferred from a security policy or a public warning.
Sources: S1
Likewise, a patched Windows estate is not demonstrated by an announcement that a fix exists. A meaningful result would show that affected devices received the remediation, that stale registrations and writable load paths are investigated where relevant, and that a standard user cannot reproduce the local route into a privileged process described by Project Zero. This is particularly salient because the research describes an incomplete prior fix: vulnerability management needs validation that the specific escalation condition is gone, not only a record that an earlier CVE was addressed.
Sources: S2
What could change the assessment
Several facts would materially sharpen the Colorado assessment: the initial access vector, the identity and role of the altered equipment, whether credentials or remote-management services were involved, the safeguards that limited the disruption, and confirmed attribution. None is supplied here. Evidence that the affected utilities had an internet-exposed OT interface would strengthen the case for exposure as the entry condition; evidence of an internal compromise or third-party connection would point defenders toward a different boundary.
Sources: S1
For the Windows issue, the key questions are which supported Windows versions and configurations remain affected before remediation, how broadly the CrossDevice registration appears in deployed estates, and whether comparable dangling registrations are writable and reachable through privileged services that allow custom marshaling. Project Zero explicitly says other privileged services may exist and notes that its described technique can also expose buggy COM custom unmarshalers. That is a reason to prioritize the fixed vulnerability while examining the broader class carefully, not a basis to declare every missing COM server exploitable.
Sources: S2
Why it matters
The strategic mistake is to collapse these developments into a single threat narrative. The Colorado reporting is about reported manipulation of real-world utility controls; the Project Zero post is a technical demonstration of a local Windows escalation route. Their shared lesson is institutional: security controls are delivered only when an organization can show that outside access is constrained, low-privilege access cannot silently become high privilege, consequential changes are detected, and operations can be restored safely. The evidence does not link the events, but it does support designing defenses so that compromise of one layer does not automatically become control of the next.
Sources
- Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems — SecurityWeek ·
- Windows Exploitation Techniques: Dangling COM Object Registrations — Google Project Zero ·