OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-96217Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow in the Windows NTFS file system driver allows an authorized local user to elevate their privileges to administrator level. An attacker with a user account could exploit this through crafted NTFS operations to gain full system control.

What this means
What could happen
A user with standard access to a Windows computer could run commands with administrative privileges by exploiting a flaw in how Windows handles NTFS file system operations. This could allow them to modify critical system files, access restricted data, or disable security controls.
Who's at risk
Windows IT managers and OT personnel running Windows workstations or servers, including organizations using Windows servers as engineering workstations or HMI (human-machine interface) hosts for industrial control systems. Affects Windows 10 (all versions and architectures), Windows 11 (all versions and architectures), Windows Server 2016 through 2025, and Server Core installations.
How it could be exploited
An attacker with a user account on the system could trigger the heap-based buffer overflow in the NTFS driver by performing specially crafted file system operations. This would require local access and the ability to execute code on the machine.
Prerequisites
  • Valid user account on the Windows system
  • Local code execution capability
  • No special privileges required initially
Locally exploitableLow complexityRequires valid user credentialsNo authentication bypassAffects common Windows infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 21H2 for ARM64-based SystemsAll versionsBuild 10.0.19044.7807
Windows 10 Version 21H2 for x64-based SystemsAll versionsBuild 10.0.19044.7807
Windows 10 Version 22H2 for 32-bit SystemsAll versionsBuild 10.0.19045.7807
Windows 10 Version 22H2 for ARM64-based SystemsAll versionsBuild 10.0.19045.7807
Windows 10 Version 22H2 for x64-based SystemsAll versionsBuild 10.0.19045.7807
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the October 2026 Windows security update to your Windows Server 2016, 2019, 2022, and 2025 systems
All products
HOTFIXApply the October 2026 Windows security update to your Windows 10 and Windows 11 systems
View full vendor advisory
API: /api/v1/advisories/0e41e4b3-d835-4924-841b-5ae35e526610

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.