CVE-2026-50402

What it actually does

This vulnerability is a local privilege escalation flaw in the Windows NTFS file system caused by incorrect conversion between numeric types. An attacker who already has a valid low-privileged local account or code execution on an affected Windows system could trigger the flaw through crafted local file system operations and cause NTFS to mishandle size, offset, length, or related numeric values. Successful exploitation can allow the attacker to execute code with elevated privileges, potentially reaching SYSTEM-level control and gaining full confidentiality, integrity, and availability impact on the host.

Why it matters to the business

If exploited, this flaw can turn a limited foothold on a Windows workstation or server into full control of that machine. This increases the risk from phishing, malware, stolen user credentials, exposed remote access, or compromised low-privileged service accounts because the attacker can use this bug to bypass normal privilege boundaries. Affected platforms include widely deployed Windows 10, Windows 11, and Windows Server versions, so organizations should treat it as important even though it is not currently listed in CISA KEV, has low EPSS, and has no known mature public exploit at this time.

How an attack unfolds

An attacker must first obtain local access to an affected Windows system, such as through a compromised user account, malicious document execution, malware running as a standard user, or abuse of an exposed service that provides low-privileged code execution. The attacker then performs specially crafted NTFS file system operations designed to trigger the incorrect numeric type conversion in the Windows NTFS driver. If the vulnerable code path is reached successfully, NTFS miscalculates or mishandles an internal value, allowing the attacker to corrupt or manipulate privileged kernel-controlled state. The attacker can then elevate from a low-privileged context to a high-privileged context, commonly SYSTEM, and use that access to disable defenses, dump credentials, install persistence, access protected data, or move laterally. There is no current indication from the provided data that this vulnerability is being exploited in known ransomware campaigns or by named threat actors.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. Where exact fixed build numbers are not available, use the latest cumulative update from Microsoft for the affected operating system branch and confirm the system is no longer missing the update through Windows Update, WSUS, Microsoft Configuration Manager, Intune, or enterprise vulnerability management tooling. Prioritize systems where low-privileged users can log on interactively, shared workstations, virtual desktop infrastructure, jump hosts, file servers, terminal servers, and internet-facing servers where another flaw could provide initial code execution. If immediate patching is not possible, reduce risk by restricting local logon rights, limiting write access to sensitive NTFS volumes, enforcing least privilege, blocking untrusted code execution, enabling attack surface reduction rules, monitoring for suspicious privilege escalation behavior, and ensuring endpoint detection and response controls are active.

How to confirm the fix worked

Confirm that each affected Windows system has installed the relevant Microsoft cumulative security update released for this vulnerability or a later superseding update. Validate patch status using Windows Update history, WSUS or Configuration Manager compliance reports, Intune update compliance, PowerShell inventory, or vulnerability scanner authenticated checks. Confirm operating system build numbers align with patched Microsoft baselines for the relevant Windows release channel. For exposure validation, identify unpatched Windows 10, Windows 11, and Windows Server systems that permit local user logon, host untrusted workloads, or run services under low-privileged accounts. Because this is a local privilege escalation flaw, external network scanning alone is insufficient; use authenticated asset inventory and patch verification.

Typical attack path

1. Gain initial local access to an affected Windows endpoint or server using stolen credentials, malware, phishing, remote service compromise, or another vulnerability.
2. Run attacker-controlled code as a low-privileged local user or service account.
3. Create or manipulate files, directories, metadata, or NTFS-specific structures in a way that reaches the vulnerable numeric conversion path.
4. Trigger the NTFS privilege escalation condition and obtain elevated execution, potentially as SYSTEM.
5. Use elevated privileges to disable security tools, access sensitive files, dump credentials, create persistence, or stage further attacks.
6. Optionally use harvested credentials or administrative access to move laterally to other Windows systems.

How to detect it

There are no reliable vulnerability-specific indicators provided for confirmed exploitation, and local privilege escalation through NTFS may not leave a unique log entry. Detection should focus on suspicious post-exploitation behavior that follows a low-privileged process obtaining elevated privileges. Review EDR telemetry, Sysmon, Windows Security logs, PowerShell logs, service control events, driver load events, and file system activity around suspected compromise times. Look for standard-user processes spawning elevated shells or administrative tools, unexpected creation or modification of Windows services, unusual scheduled tasks, credential dumping attempts, tampering with Microsoft Defender or EDR agents, abnormal access to LSASS, unexpected kernel driver loads, and sudden privilege changes by accounts that should not administer the host. Useful Windows event sources include Security event IDs 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for logon activity, 7045 from the System log for service installation, 4698 for scheduled task creation, PowerShell Operational logs for script execution, and Sysmon events for process creation, file creation, image load, and driver load where deployed. Because no named threat actor or public exploit pattern is currently associated with this vulnerability, SOC teams should correlate suspicious local elevation activity with unpatched affected Windows assets rather than depending on fixed strings or signatures.

What your security team should do

• Patch affected Windows workstations and servers with the latest Microsoft cumulative security updates, prioritizing systems with interactive users, shared access, administrative tooling, or critical business roles.
• Use authenticated vulnerability scanning or endpoint management reporting to identify affected Windows versions that remain unpatched.
• Harden privilege boundaries by removing unnecessary local administrator rights and limiting local logon rights for standard users and service accounts.
• Increase monitoring for suspicious local privilege escalation patterns, including standard-user processes spawning SYSTEM shells, unexpected service creation, driver loading attempts, credential dumping, or tampering with security controls.
• Correlate this vulnerability with initial-access risks: systems vulnerable to remote code execution, exposed remote access, or frequent phishing exposure should be patched first because this flaw is most useful after an attacker already has a foothold.
• Review EDR and Windows event telemetry for post-exploitation behavior rather than relying on a single vulnerability-specific indicator, as no stable public exploit indicator is currently available.
• Maintain rapid rollback and recovery capability for business-critical servers before patch deployment, but do not defer patching solely because EPSS is currently low.