Windows NTFS Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-70010Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A heap-based buffer overflow in Windows NTFS allows an authorized local user to elevate privileges to system level. Exploitation is unlikely in the wild but requires only local file system interaction. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 across multiple architectures (32-bit, x64, ARM64).
What this means
What could happen
A user with local logon access could exploit a buffer overflow in NTFS to gain system-level privileges, allowing them to bypass access controls and modify critical files or settings on the computer.
Who's at risk
This affects all organizations running Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025. Any system with local user accounts is at risk, including workstations used by operators and engineering staff at utilities, water authorities, and manufacturers that run HMI (Human Machine Interface), SCADA, or historian systems on Windows-based devices.
How it could be exploited
An attacker with an existing local user account on the machine exploits a heap buffer overflow in the Windows NTFS driver by crafting a malicious file or triggering a specific NTFS operation. If successful, the attacker gains system-level privileges without further interaction.
Prerequisites
- Local user account on the Windows system
- Ability to interact with NTFS filesystem (e.g., create or modify files)
- Local logon access to the machine
local exploitation only (not remotely exploitable)requires valid local user credentialslow complexity attackno authentication required beyond existing local accountaffects many widely-deployed Windows versions
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDIf immediate patching is not feasible, restrict local logon privileges to trusted administrators only
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXInstall the October 2026 Windows security update for your Windows version and system architecture
Long-term hardening
0/1HARDENINGImplement endpoint detection and response (EDR) tooling to monitor for privilege escalation attempts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/be8a572c-baac-443e-b3bc-9e9bdb42c684Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.