OTPulse

Windows NTFS Remote Code Execution Vulnerability

Plan PatchCVSS 7.8CVE-2026-50308Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

An integer underflow vulnerability in Windows NTFS allows a local attacker to execute arbitrary code. The vulnerability is triggered through specially formed file system interactions and does not require elevated privileges or network access. Microsoft has released patches for all affected versions across Windows 10, Windows 11, and Windows Server platforms (2016 through 2025).

What this means
What could happen
An attacker with local access to a Windows machine could exploit an integer underflow in NTFS to run arbitrary code with elevated privileges, potentially compromising the entire system and any connected networks or control systems.
Who's at risk
This vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems running on 32-bit, x64, and ARM64 architectures. It is particularly relevant to utilities using Windows-based engineering workstations, control system servers, and management systems that interact with NTFS-based storage.
How it could be exploited
An attacker would need to craft a specially formed file or interact with the NTFS file system locally, then trigger the vulnerable code path to cause an integer underflow. This could allow execution of arbitrary commands on the affected Windows system.
Prerequisites
  • Local access to the Windows system
  • User interaction required (file access or user action to trigger the vulnerability)
  • No elevated privileges required for initial exploitation
low complexity attacklocal access requireduser interaction requiredaffects a wide range of Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Microsoft's July 2026 security update for your Windows version (Build 10.0.17763.9020 for Windows 10 1809/Server 2019, Build 10.0.19044.7548 for Windows 10 21H2, Build 10.0.19045.7548 for Windows 10 22H2, Build 10.0.26100.33158 for Server 2025, or equivalent for your version)
Long-term hardening
0/2
HARDENINGRestrict local system access to trusted users only; limit who can log in locally to Windows servers used in industrial control or network operations
HARDENINGMonitor file system access logs on critical Windows systems for suspicious file activity that could indicate exploitation attempts
View full vendor advisory
API: /api/v1/advisories/258fd96b-dc17-419d-bc9e-ede8617eb723

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.