OTPulse

Windows NTFS Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-96918Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally. An attacker with a standard user account on the system can exploit this flaw to gain administrator-level access. Exploitation is assessed as less likely in the current threat landscape.

What this means
What could happen
A user with a standard Windows account could gain administrator-level access on a local workstation or server, allowing them to run privileged commands, modify system settings, or access sensitive files.
Who's at risk
Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025 systems are affected. This matters to any organization running Windows workstations or servers, particularly those with multi-user systems or shared Remote Desktop sessions where standard users may have local access.
How it could be exploited
An attacker with an existing user account on the system exploits improper access control in the Windows NTFS file system to escalate their privileges from standard user to administrator. This requires local access to the machine; remote exploitation is not possible with this vulnerability alone.
Prerequisites
  • Valid user account on the affected Windows system
  • Local access to the machine (physical or RDP session with standard user credentials)
  • NTFS file system in use (default on Windows)
Local access requiredStandard user privileges sufficientNTFS default configuration affected
Exploitability
Unlikely to be exploited - EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1607 for 32-bit SystemsAll versionsBuild 10.0.14393.9612
Windows 10 Version 1607 for x64-based SystemsAll versionsBuild 10.0.14393.9612
Windows Server 2016All versionsBuild 10.0.14393.9612
Windows Server 2016 (Server Core installation)All versionsBuild 10.0.14393.9612
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/1
Schedule - requires maintenance window
0/1

Patching may require device reboot, plan for process interruption

HOTFIXApply the October 2026 Windows security update for your Windows version (see affected products for specific build numbers)
View full vendor advisory
API: /api/v1/advisories/b91af067-ed2c-41e4-9691-45794ddcb524

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.