Windows NTFS Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-83737Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Out-of-bounds read in Windows NTFS allows a local authorized user to disclose sensitive information. An attacker with a valid user account on a Windows system can trigger this vulnerability in the NTFS driver to read data outside intended boundaries, potentially exposing credentials, configuration files, or other sensitive data stored on the system.
What this means
What could happen
An attacker with local access to a Windows machine can read sensitive data from memory or disk that they should not be able to access. This could expose configuration details, credentials, or operational data stored on engineering workstations or OT servers.
Who's at risk
Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems used as engineering workstations, HMIs, or OT servers. This is especially relevant for systems that store sensitive configuration data, PLC programming files, or network credentials related to industrial controls.
How it could be exploited
An attacker who already has a local user account on a Windows system can trigger an out-of-bounds read in the NTFS driver to access sensitive information. The attacker does not need special privileges—a standard user account is sufficient—making this a lateral movement risk if a workstation is compromised.
Prerequisites
- Local user account on Windows machine (standard user privileges sufficient)
- Direct access to or compromise of a Windows workstation or server
Low complexity exploitationNo authentication required (local user account sufficient)Information disclosure of sensitive data
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply Windows October 2026 security updates to all affected Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
Long-term hardening
0/2HARDENINGRestrict local login access to Windows workstations and servers to authorized personnel only
HARDENINGEnforce strong password policies and multi-factor authentication for local accounts on engineering workstations
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/79d82e69-a6bb-4a9f-bb1e-3d06c21a94e7Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.