Windows NTFS Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-62880Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds read vulnerability exists in the Windows NTFS driver. An authorized local user can exploit this to read kernel memory and escalate privileges to administrator level, potentially compromising the confidentiality and integrity of the affected system.
What this means
What could happen
A local user with standard privileges could read sensitive kernel memory and escalate to administrator access on Windows systems running NTFS. This could allow an attacker to gain full control of a supervisory or engineering workstation.
Who's at risk
IT managers running Windows 10, Windows 11, Windows Server 2016/2019/2022/2025 systems should be concerned. This affects engineering workstations, HMI systems, and office servers that allow local user login. Particular attention needed for systems supporting ICS/OT networks where workstations handle both enterprise and critical control functions.
How it could be exploited
An attacker with a local user account on the system exploits an out-of-bounds read in the NTFS driver by crafting a malicious file system request. The attacker reads kernel memory to leak credentials or security tokens, then uses that information to escalate to administrator or system privileges.
Prerequisites
- Local user account on the Windows system (non-administrator)
- NTFS file system in use
- System has not been patched with 2026-Aug or later security update
Local privilege escalationLow attack complexityRequires valid local user accountAffects multiple Windows versions and architecturesLow exploit probability (0.2% EPSS)
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the 2026-Aug Windows security update (or later) to all affected Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/d998911d-0b4f-40a8-b1b8-d71cf22e9341Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.