OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7CVE-2026-69567Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

Use-after-free vulnerability in Windows NTFS that allows an authorized local user to escalate privileges on affected Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems.

What this means
What could happen
A user with local access to a Windows computer could exploit this flaw to gain administrative privileges, potentially allowing them to install software, modify system settings, or access sensitive data on HMI workstations and engineering computers used in your facility.
Who's at risk
IT staff and engineers using Windows 10 or Windows 11 workstations, as well as servers running Windows Server 2016, 2019, 2022, or 2025 that are used for engineering, data collection, or HMI access in water and utility environments. This affects all versions of the listed operating systems.
How it could be exploited
An attacker with local user access to a Windows machine exploits a use-after-free condition in the NTFS driver to escalate privileges to administrator/system level. The attack requires the attacker to already have a local user account on the machine.
Prerequisites
  • Local user account on the Windows system
  • High complexity exploitation (AC:H indicates significant technical difficulty)
local privilege escalationrequires valid local accounthigh complexity attackaffects multiple Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the September 2026 Windows security update to all Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems in your environment
Long-term hardening
0/2
HARDENINGRestrict local user account creation and management; audit existing local accounts on engineering workstations and servers to remove unnecessary accounts
HARDENINGImplement application whitelisting and code integrity policies on critical engineering workstations to restrict unauthorized application execution
View full vendor advisory
API: /api/v1/advisories/d88bbbe0-65c7-4f00-9d16-234dbf77e847

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows NTFS Elevation of Privilege Vulnerability | CVSS 7 - OTPulse