OTPulse

Windows NTFS Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-62796Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in Windows NTFS allows a local authenticated attacker to disclose sensitive information from file system memory. The vulnerability affects all supported versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. Microsoft has released patches for all affected operating systems.

What this means
What could happen
An attacker with local access to a Windows system can read sensitive data from NTFS file system memory that should not be accessible to them, potentially exposing passwords, configuration data, or other confidential information stored on disk.
Who's at risk
All organizations running Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025 are affected. This impacts any Windows system where untrusted or shared local user accounts may exist, including workstations, file servers, and remote access systems.
How it could be exploited
An attacker with a local user account on a Windows system can trigger an out-of-bounds read in the NTFS driver by accessing specific file system operations. This allows them to read portions of kernel memory or file system buffers that should be restricted to the attacker's privilege level, bypassing normal access controls.
Prerequisites
  • Local user account on the Windows system
  • Ability to execute file system operations (read/write files)
  • No special privileges required beyond standard user
requires local authenticationlow EPSS score (0.3%)information disclosure only (no code execution)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the August 2026 Windows security update to your Windows 10, Windows 11, and Windows Server systems immediately
Long-term hardening
0/2
HARDENINGRestrict local login access to Windows systems to only authorized personnel and service accounts
HARDENINGImplement local account management controls and disable unnecessary local user accounts
View full vendor advisory
API: /api/v1/advisories/b5ce0632-caf1-4bd0-9728-406789b7e661

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.