Windows NTFS Elevation of Privilege Vulnerability
MonitorCVSS 6.7CVE-2026-72935Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds read vulnerability exists in the Windows NTFS file system driver that allows an authorized attacker with local administrator privileges to read sensitive data from memory or cause a denial of service condition. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across all architectures. Microsoft has released security updates in September 2026 to address this issue.
What this means
What could happen
An attacker with local administrator privileges could read sensitive data from memory or crash the system through an out-of-bounds read in the NTFS file system driver. This could lead to unauthorized access to confidential files or denial of service if a critical server is affected.
Who's at risk
Windows system administrators responsible for Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 deployments. This affects all versions of these operating systems across 32-bit, x64, and ARM64 architectures, including Server Core installations.
How it could be exploited
An attacker with local administrator access exploits an out-of-bounds read vulnerability in the NTFS driver by crafting a malicious file system request or mounting a specially crafted disk image. The vulnerability allows reading data outside intended memory boundaries, potentially exposing sensitive information or causing a crash.
Prerequisites
- Local administrator or equivalent privileged account credentials
- Local access to the Windows system
- Ability to interact with NTFS file system (e.g., mount a volume or create files)
Local privilege escalation required (not remotely exploitable without local access)Requires high privileges (administrator) to exploitLow exploit probability (EPSS 0.3%)Affects data confidentiality and system availability
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Windows security update for 2026-Sep (September 2026 Patch Tuesday) to your Windows systems
Long-term hardening
0/2HARDENINGRestrict local administrator account access to only necessary personnel and implement regular audits of privileged account usage
HARDENINGMonitor file system access attempts and unusual NTFS driver activity for signs of exploitation
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/24e30061-d354-4871-9571-d9f0774b8c58Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.