Windows NTFS Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-62700Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A heap-based buffer overflow exists in Windows NTFS that allows an authorized local user to elevate their privileges to system level. The vulnerability requires an authenticated local account and could allow an attacker to gain full system privileges, potentially impacting the confidentiality, integrity, and availability of the Windows system.
What this means
What could happen
An attacker with a local user account on a Windows machine could exploit a heap buffer overflow in NTFS to gain system-level privileges, potentially allowing them to modify files, disable security controls, or run malicious code with elevated permissions.
Who's at risk
Windows system administrators and OT personnel using Windows 10 or Windows Server (2016 through 2025) for SCADA workstations, HMI servers, historian systems, or engineering stations. Any Windows machine with local user accounts that could be compromised or misused by insiders.
How it could be exploited
An attacker with a valid local user account could craft a specially formed request to the NTFS driver that triggers a heap buffer overflow, allowing them to write to memory and overwrite privilege escalation structures. This requires local file system access but no special tools or complexity.
Prerequisites
- Valid local user account on the Windows machine
- Local file system access
- No remote exploitation path; attacker must have local logon capability
requires local authenticationlow complexity exploitationaffects NTFS file system used by all Windows machinesprivilege escalation from user to system level
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXPrioritize systems running Windows Server 2019 and Server 2022 as these are commonly used in OT network management and data collection roles
All products
HOTFIXApply the 2026-Aug Windows security update to all affected Windows 10 and Windows Server systems
Long-term hardening
0/2HARDENINGRestrict local user account creation and management to only authorized personnel; disable unnecessary local accounts
HARDENINGEnforce strong password policies and multi-factor authentication for all local accounts with file system access
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/05c4c28b-0902-4626-b1d5-0b940cfb7348Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.