OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-83995Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow in Windows NTFS file system processing allows a user with a local account to elevate privileges to administrator level. The vulnerability is triggered when the OS processes a specially crafted file or directory structure on an NTFS volume. Privilege escalation is less likely under typical conditions but possible with deliberate exploitation. All versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 are affected.

What this means
What could happen
A user with local account access could exploit a buffer overflow in NTFS file system processing to gain administrator privileges on the machine. This could allow them to install persistent backdoors, access sensitive data, or disable security controls on HMI stations or engineering workstations in your facility.
Who's at risk
Windows servers and workstations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 are affected. This matters most for HMI stations, engineering workstations, and operator consoles in your network where privileged users work, as well as any servers hosting OT-related applications or databases.
How it could be exploited
An attacker with a standard user account on a Windows machine could craft a malicious file or directory structure on an NTFS volume that triggers the buffer overflow when the OS processes the file system. By exploiting the vulnerability, they escalate from user-level to administrator-level privileges without further interaction.
Prerequisites
  • Local user account on affected Windows system
  • Access to NTFS file system (write access to local volume or network share)
  • User must log in or the attacker must already have execution context on the machine
Local execution requiredLow authentication complexity (standard user)Affects most current Windows platforms
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply Windows September 2026 security update to all affected systems (Windows 10, Windows 11, Windows Server 2016/2019/2022/2025)
Long-term hardening
0/2
HARDENINGRestrict user account creation and local administration rights to essential personnel only
HARDENINGMonitor for suspicious privilege escalation attempts in Event Viewer Security logs
View full vendor advisory
API: /api/v1/advisories/26bc2110-280f-4974-a3b7-cdfbb840e5ae

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows NTFS Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse