OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-70172Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An untrusted pointer dereference vulnerability in Windows NTFS allows an authorized local user to escalate privileges to administrator level. The vulnerability affects all supported versions of Windows 10, Windows 11, and Windows Server platforms (2016 through 2025) across 32-bit, x64, and ARM64 architectures. Exploitation requires an existing user account on the system and does not require additional credentials or user interaction. Microsoft has released patches for all affected versions.

What this means
What could happen
An authorized user with local access to a Windows system could exploit an NTFS vulnerability to gain administrative privileges, potentially allowing them to modify critical data, disable security controls, or compromise system integrity on OT workstations and servers.
Who's at risk
This affects all Windows 10, Windows 11, and Windows Server systems (2016 through 2025) across multiple architectures. If your plant runs Windows-based HMIs, engineering workstations, or server infrastructure—including SCADA data historians, remote desktop servers, or automation control systems hosted on Windows—you should prioritize patching these systems.
How it could be exploited
An attacker with a regular user account on a Windows system could craft a malicious file or interact with the NTFS filesystem to trigger a pointer dereference vulnerability, escalating their privileges to administrator or system level without requiring additional authentication.
Prerequisites
  • Local user account on the affected Windows system
  • No exploit code currently known to be in active use
  • Requires user-level privileges to initiate exploitation
Local privilege escalationLow complexity attackRequires existing user account accessAffects wide range of Windows versionsLow EPSS score—not actively exploited
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict local system access by disabling unnecessary user accounts and limiting who can log into workstations and servers, particularly privileged accounts.
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply Microsoft's October 2026 security update to all affected Windows systems (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, 2025). Check Microsoft Update or WSUS for available patches matching your system version and architecture.
Long-term hardening
0/1
HARDENINGEnable Windows Defender Application Guard or similar process isolation on engineering workstations to contain potential privilege escalation attempts.
View full vendor advisory
API: /api/v1/advisories/0f2823a2-a22e-4ecc-8e0d-2bd234e5afc9

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.