OTPulse

Windows NTFS Remote Code Execution Vulnerability

Plan PatchCVSS 8.4CVE-2026-69638Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow vulnerability exists in the Windows NTFS file system driver. An attacker with local system access could craft malicious input to trigger the overflow and execute arbitrary code. All Windows 10, Windows 11, and Windows Server 2016 through 2025 editions are affected. Microsoft has released patches for all supported versions.

What this means
What could happen
A local attacker could exploit a buffer overflow in NTFS to run arbitrary code on Windows systems, potentially compromising HMI workstations, engineering stations, or servers that control or monitor industrial processes.
Who's at risk
This affects Windows systems across multiple versions and architectures used in OT environments, including Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. Organizations running engineering workstations, HMI platforms, historians, or automation servers on these operating systems should prioritize updates.
How it could be exploited
An attacker with local access to a Windows system could craft a malicious file or network share interaction that triggers a heap-based buffer overflow in the NTFS driver. Successful exploitation would allow code execution with the privileges of the process triggering the overflow.
Prerequisites
  • Local access to the Windows system (physical access, RDP session, or compromised user account)
  • Ability to interact with NTFS (create files, access network shares, or trigger file operations)
requires local access (lower immediate risk but critical if insider threat or lateral movement occurs)high CVSS score (8.4)wide distribution across Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-September Windows security update for all Windows systems in your OT environment
HOTFIXPrioritize patching Windows systems that host engineering workstations, HMI servers, or historian databases
Long-term hardening
0/2
HARDENINGRestrict physical and remote access to Windows systems in the control network to authorized personnel only
HARDENINGImplement network segmentation to isolate Windows-based OT systems from untrusted networks and limit credential exposure
View full vendor advisory
API: /api/v1/advisories/cd254980-663a-45dd-a8ee-48fae28e90be

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows NTFS Remote Code Execution Vulnerability | CVSS 8.4 - OTPulse