OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-83508Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in Windows NTFS file system allows a user with local access to elevate their privileges to a higher level on the system.

What this means
What could happen
A user with local account access on a Windows server or workstation could exploit this vulnerability to gain administrative privileges, allowing them to take full control of the system and potentially interfere with industrial control software or data integrity.
Who's at risk
Windows system administrators and OT security staff responsible for Windows-based HMI systems, engineering workstations, data historians, and supervisory control servers running any version of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025. This affects all computing infrastructure that runs these operating systems in industrial facilities.
How it could be exploited
An attacker with a local user account on an affected Windows system (such as an HMI workstation, engineering station, or historian server) can trigger an out-of-bounds read in the NTFS driver to escalate privileges to administrator level without needing additional authentication or user interaction.
Prerequisites
  • Local user account on the affected Windows system
  • Windows NTFS file system in use (standard for Windows systems)
Requires local account accessLow complexity attackAffects all major Windows versionsHigh impact on system control
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXPrioritize patching Windows Server 2016, 2019, 2022, and 2025, as well as Windows 10 and 11 systems used for HMI, engineering workstations, and historian servers
All products
HOTFIXApply the October 2026 Windows security update or later to all affected systems
Long-term hardening
0/2
HARDENINGRestrict local user account creation and access on critical OT workstations to authorized personnel only
HARDENINGMonitor privileged account activity and login attempts on OT-connected systems for suspicious escalation patterns
View full vendor advisory
API: /api/v1/advisories/f1b26aaa-b6f7-4b40-bd5e-baef2ecf0e87

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.