Windows NTFS Remote Code Execution Vulnerability
Plan PatchCVSS 7.8CVE-2026-50461Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Heap-based buffer overflow in Windows NTFS file system driver allows an attacker with local file access to execute arbitrary code with system privileges. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across 32-bit, 64-bit, and ARM64 architectures.
What this means
What could happen
An attacker with local access to a Windows system could trigger a buffer overflow in the NTFS file system driver, potentially running arbitrary code with elevated privileges. This could allow the attacker to disable safety interlocks, alter process parameters, or shut down critical operations.
Who's at risk
Water utilities and power plants using Windows-based engineering workstations, SCADA servers, or HMI systems running Windows 10, Windows 11, or Windows Server 2016–2025. This affects any facility that relies on Windows hosts for process monitoring, data logging, or remote access gateways.
How it could be exploited
An attacker would need local access to a Windows machine (e.g., via a compromised engineering workstation, removable media, or previous remote compromise). The attacker would craft a malicious file that triggers the heap buffer overflow in the NTFS driver when accessed or processed, causing the system to execute attacker-controlled code.
Prerequisites
- Local file system access or ability to create/modify files on the Windows system
- User interaction to access or process the malicious file
- System running one of the affected Windows versions
Low remote exploitability (local access required)User interaction requiredLow EPSS score (0.3%)Affects all major supported Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the July 2026 Windows security update to bring all systems to the latest patched build for your Windows version
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/e933ec18-1960-48d5-908f-cb417ec245a4Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.