OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.1CVE-2026-69340Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionRequired
Summary

Heap-based buffer overflow in Windows NTFS file system processing allows a low-privileged authenticated attacker to escalate privileges to administrative level. The vulnerability is triggered when the operating system processes a specially crafted NTFS file or directory. An attacker with valid local credentials could exploit this to gain full control of the system. The flaw affects Windows 10 (all supported versions), Windows 11 (all supported versions), and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions. Exploitation requires user interaction to process the malicious file, making widespread remote exploitation less likely but still feasible in targeted scenarios.

What this means
What could happen
An attacker with a low-privileged local account could exploit a buffer overflow in NTFS file processing to gain administrative privileges on the system. This could allow them to take full control of any Windows-based HMI, data historian, or engineering workstation in your OT network.
Who's at risk
Windows 10 and Windows 11 workstations used for engineering, HMI visualization, and data access. Windows Server 2016, 2019, 2022, and 2025 systems running data historians, alarm servers, or historian services. Any server or workstation in an OT network that processes external files or user input to NTFS operations.
How it could be exploited
An attacker with valid low-privileged credentials on a Windows system crafts a malicious NTFS file or directory that triggers the buffer overflow when processed by the operating system. By exploiting this flaw, they escalate from standard user to system/administrator level, gaining control over the machine's software and any connected industrial processes it manages.
Prerequisites
  • Valid low-privileged local account credentials on the target Windows system
  • Local or remote network access to interact with NTFS file operations
  • User interaction to trigger file processing (e.g., opening a crafted file or folder)
Requires low-privileged credentials and user interactionAffects widely deployed Windows platforms across OT environmentsBuffer overflow could allow full system compromise of critical nodes
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/5
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXPrioritize patching Windows Server 2016, 2019, 2022, and 2025 systems, as these typically run data historians, HMIs, and industrial databases
All products
HOTFIXApply the September 2026 Microsoft security update to all Windows 10, Windows 11, and Windows Server systems in the OT environment
HOTFIXAfter patching, restart all affected systems to complete the update
Long-term hardening
0/2
HARDENINGRestrict local account access on Windows systems in the OT network; remove unnecessary low-privileged user accounts and enforce strong password policies
HARDENINGImplement network segmentation to limit lateral movement if a workstation is compromised; separate engineering workstations from operational control systems
View full vendor advisory
API: /api/v1/advisories/2131e6c4-a87b-4e61-995f-09f05c3c3296

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.