OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-56182Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Integer overflow or wraparound in the Windows NTFS file system allows an authorized attacker with local system access to escalate privileges. A user with standard account permissions could potentially gain administrative access by triggering the flaw through NTFS interactions. Microsoft has released patches for all supported Windows versions.

What this means
What could happen
A user with local access to a Windows workstation or server could exploit an NTFS bug to run commands with administrative privileges, potentially allowing them to modify critical system settings, access sensitive data, or compromise the integrity of the operating system.
Who's at risk
This affects IT operations staff managing Windows 10 and Windows Server systems (2016, 2019, 2022, 2025) in data centers, server rooms, and office workstations. Any organization running Windows as a base operating system for SCADA workstations, engineering stations, or server infrastructure should apply patches.
How it could be exploited
An attacker with a standard user account on a Windows workstation or server could trigger an integer overflow condition in the NTFS file system driver, escalating their privileges to administrative level. This requires local system access and cannot be exploited remotely.
Prerequisites
  • Local user account on the affected Windows system
  • Ability to interact with the NTFS file system (standard on all Windows installations)
Affects multiple Windows versionsRequires local access (not remotely exploitable)Low EPSS score (0.3%)Currently not actively exploited
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-Jul security update from Microsoft for your Windows version (see product fixes for specific build numbers)
HARDENINGReview and enforce user access control (UAC) settings to require elevation confirmation for administrative actions
Long-term hardening
0/1
HARDENINGRestrict local user account creation and limit console/RDP access to trusted users only
View full vendor advisory
API: /api/v1/advisories/c9e489fe-4200-498f-98a7-3ba6e66631b2

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.