Windows NTFS Elevation of Privilege Vulnerability
Plan PatchCVSS 7CVE-2026-81971Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
A race condition in Windows NTFS allows an authorized local attacker to elevate privileges. The vulnerability exists due to improper synchronization during concurrent execution using shared resources.
What this means
What could happen
A user with local access to a Windows system or server could gain administrative privileges, allowing them to modify system settings, access sensitive files, or disrupt operations on that machine.
Who's at risk
IT managers and OT security staff at utilities and water authorities should prioritize this for any Windows 10 or Windows Server systems used as engineering workstations, HMI servers, or domain controllers. Affects all supported versions of Windows 10, Windows Server 2016, 2019, 2022, 2025, and Windows 11.
How it could be exploited
An attacker with an unprivileged local user account could exploit a race condition in NTFS file system operations to elevate their privileges to administrator level. This requires the attacker to execute code on the target system and time malicious file operations to win a race condition in the kernel.
Prerequisites
- Local user account on the target Windows system
- Ability to execute code or commands on the target system
- Access to the same NTFS volume where the race condition can be triggered
Requires local access (not remotely exploitable from network)Requires authenticated user accountMedium complexity exploit (race condition timing required)Affects core operating system used in HMI/engineering workstations and critical servers
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict local system access and enforce principle of least privilege for user accounts on Windows systems
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update to all Windows 10, Windows Server, and Windows 11 systems
HOTFIXPrioritize patching Windows systems used as engineering workstations, HMI servers, or administrative access points to control systems
Long-term hardening
0/1HARDENINGMonitor and audit local user account creation and privileged access on Windows systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/438f8b65-bec1-49e6-b7a3-26f00dba78c6Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.