OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-69532Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in Windows NTFS file system driver allows an authorized local user to elevate privileges to administrator level. The flaw affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across 32-bit, x64, and ARM64 architectures. Microsoft has released fixes for all supported versions.

What this means
What could happen
A local user with standard privileges could exploit an out-of-bounds read flaw in NTFS to gain administrator-level access to the Windows system, potentially allowing them to modify industrial automation software, access sensitive data, or disable safety controls if running on an OT workstation or engineering machine.
Who's at risk
Windows operators running Windows 10, 11, Server 2016, 2019, 2022, or 2025 on engineering workstations, HMI systems, data historians, or other OT support systems. This affects 32-bit, x64, and ARM64 systems in all supported versions.
How it could be exploited
An attacker with an existing local user account (such as an operator or engineering workstation user) can exploit an out-of-bounds read vulnerability in the Windows NTFS file system driver to escalate their privileges to SYSTEM/administrator level on the same machine. Once elevated, they can execute arbitrary commands with full system access.
Prerequisites
  • Valid local user account on the Windows system
  • Ability to log in locally or via Remote Desktop/SSH to the affected Windows machine
  • Access to a Windows file system using NTFS
Local privilege escalationRequires valid local user accountAffects engineering/OT support workstations
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the September 2026 Microsoft security update to all affected Windows systems (10, 11, Server 2016, 2019, 2022, 2025)
Long-term hardening
0/2
HARDENINGRestrict local console access and Remote Desktop access to engineering and administrative users only
HARDENINGAudit and disable unnecessary local user accounts on OT-connected Windows machines
View full vendor advisory
API: /api/v1/advisories/3aeb0ea8-38df-4206-9452-ef2934132390

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows NTFS Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse