OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-83652Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow in Windows NTFS file system handling allows a user with a local account to escalate privileges to administrator level. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, and 2025 across all architecture variants (32-bit, x64, ARM64). Microsoft has released patches for all affected versions.

What this means
What could happen
An attacker with a local user account on a Windows system could exploit a flaw in NTFS file handling to run commands with administrative privileges, potentially compromising the entire system or any data stored on it.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 should evaluate this risk. In an OT environment, if Windows servers or workstations are part of your engineering network or historian systems, any compromise could allow an insider or an attacker with local access to modify control settings, disable safety systems, or exfiltrate operational data.
How it could be exploited
An attacker must first have a local user account on the Windows system. They then craft a malicious NTFS file or interact with the file system in a way that triggers a heap buffer overflow in the Windows NTFS driver, allowing them to escalate their privileges to administrator level.
Prerequisites
  • Local user account on the Windows system
  • Ability to write to or interact with NTFS file system
Requires local user account (insider risk or prior compromise)Low complexity exploitationAffects file system driver used by all Windows systemsPrivilege escalation could lead to full system compromise
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/4
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXPrioritize patching systems running Windows Server 2016, 2019, or 2022 if those are used in your control network infrastructure
All products
HOTFIXApply the October 2026 Windows security update to all affected systems (see product fixes for specific build numbers)
Long-term hardening
0/2
HARDENINGRestrict local user account creation to necessary personnel only and enforce strong password policies for all local accounts
HARDENINGReview and audit local user accounts on all Windows systems to remove unnecessary accounts
View full vendor advisory
API: /api/v1/advisories/fc87c7f4-63fd-4579-af94-97b01b6b7903

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows NTFS Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse