OTPulse

NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-50402Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An incorrect conversion between numeric types in the Windows NTFS file system allows an authorized user with local access to elevate their privileges to system level.

What this means
What could happen
An attacker with a regular user account on your server could gain administrator-level access, allowing them to modify files, install software, or alter system configurations including those affecting industrial processes or data integrity.
Who's at risk
Organizations running Windows Server 2016, 2019, 2022, or 2025, or Windows 10/11 workstations in IT environments where system administrators and support staff have local user accounts. This affects any organization using Windows NTFS systems, including those with HMI/SCADA workstations, engineering stations, or Windows-based data historians.
How it could be exploited
An attacker with local user credentials could exploit the NTFS numeric type conversion flaw to escalate privileges from a standard user account to administrator or system level without requiring additional authentication or user interaction.
Prerequisites
  • Local user account credentials on a Windows workstation or server
  • Physical or remote access to a logged-in session (e.g., via RDP or physical terminal)
  • Windows NTFS file system in use
Local privilege escalationLow complexity exploitationRequires valid user credentialsAffects Windows server and workstation systems widely deployed in IT/OT environments
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Public Proof-of-Concept (PoC) on GitHub (1 repository)
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the July 2026 Microsoft security update to all affected Windows systems
Long-term hardening
0/2
HARDENINGReview and enforce user account access controls to limit the number of local user accounts on servers
HARDENINGEnable auditing of privilege escalation events and monitor for suspicious elevation attempts
View full vendor advisory
API: /api/v1/advisories/9cf96d13-9fe7-4da5-a351-0a7c24d733f0

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.