Windows NTFS Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-96935Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A flaw in the Windows NTFS file system allows an authorized local user to read sensitive metadata that their privilege level should not permit. This is a local-only information disclosure issue affecting NTFS-formatted drives on Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. Microsoft has released fixes for all supported versions.
What this means
What could happen
An attacker with local access to a Windows system can read sensitive NTFS metadata that should not be accessible to their privilege level, potentially exposing system configuration or file information.
Who's at risk
Any organization running Windows 10, Windows 11, or Windows Server 2016, 2019, 2022, or 2025. This affects general-purpose workstations and servers but poses greatest risk on shared computers, remote desktop systems, or machines where untrusted users may gain local access.
How it could be exploited
An attacker must already have local user access to the Windows system. They can then query NTFS file system metadata through local API calls to access information that their privilege level should not permit, without requiring administrative rights or user interaction.
Prerequisites
- Local user account on the Windows system
- No remote exploitation possible; attacker must have local logon access
- Low privilege user account is sufficient
No authentication required after local accessLow attack complexityLow EPSS score (unlikely to be exploited broadly)
Exploitability
Unlikely to be exploited - EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/2
Schedule - requires maintenance window
0/2Patching may require device reboot, plan for process interruption
HOTFIXApply the October 2026 Windows security update for your Windows 10/11 and Windows Server version
HARDENINGPrioritize updates for systems that run desktop applications accessible to untrusted users or shared workstations
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/0421a9af-c8c1-4efd-9d24-d0ffcc57a424Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.