OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-69312Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in Windows NTFS allows an authorized local user to elevate privileges by crafting malicious file system requests that read kernel memory. This affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (all versions), and Windows Server 2016, 2019, 2022, and 2025. Exploitation is considered unlikely. Microsoft has released patches in the September 2026 security update for all affected versions.

What this means
What could happen
A user with local access to a Windows system can exploit an NTFS vulnerability to run commands with elevated privileges, potentially allowing control of engineering workstations or HMI systems that manage industrial processes.
Who's at risk
Windows 10 systems (versions 1607, 1809, 21H2, 22H2) and Windows Server systems (2016, 2019, 2022, 2025) used as engineering workstations, HMI servers, and data historians in water utilities and electric utilities. Any facility running SCADA historian databases or control system workstations on these Windows versions is affected.
How it could be exploited
An attacker with a local user account on a Windows computer crafts a malicious NTFS file system request that triggers an out-of-bounds read. By reading kernel memory, the attacker can bypass privilege restrictions and gain administrative access to the system.
Prerequisites
  • Local user account on the affected Windows system
  • Ability to trigger NTFS file operations (built-in functionality)
Requires local account accessLow complexity exploitationAffects elevated privilegesAffects common enterprise operating systems
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/3
Do now
0/2
HARDENINGRestrict local user account creation and logon privileges to engineering workstations to only trusted personnel
HARDENINGApply principle of least privilege: remove unnecessary local administrator group memberships from user accounts
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXInstall Microsoft's September 2026 security update (or later monthly patch) on all affected Windows 10 and Windows Server systems
View full vendor advisory
API: /api/v1/advisories/1d9bd6c5-799f-4fef-ad82-66454771febf

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.