Windows admin-to-kernel exploit went unpatched for 6 months