CVE-2026-62880

Windows NTFS Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your Windows version/build number on each affected machine (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019/2022/2025) and confirm whether it is below the fixed build listed by Microsoft for CVE-2026-62880.
Install the Microsoft security update for CVE-2026-62880 from the MSRC update guide as soon as possible.
Re-check the build number after updating to verify you reached one of the fixed versions listed for your Windows branch.
If you can’t patch immediately, isolate the machine from untrusted networks and reduce the chance an attacker can obtain low-level access (for example, lock down local accounts, remove unnecessary admin/developer access, and review endpoint detections for suspicious activity around file access).

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62880 is a Windows NTFS flaw that can let someone with low-level access take full control of your computer; if your business PCs or servers are exposed to attackers who can already run code or gain low permissions, you should act.

CVE-2026-62880 is a local elevation-of-privilege flaw in the Windows NTFS file system (CWE-125) where low-privilege attackers can trigger an out-of-bounds read to gain higher system permissions; no CISA KEV listing was found.

If you're affected

Full server or workstation takeover
Malware runs with system privileges
Data theft and ransomware risk
Service disruption

What is it

NTFS is Windows’ main way of reading and organizing files. This vulnerability is a “how Windows checks file boundaries” bug—if an attacker can already get a foothold with low permissions, they can use a crafted file situation to trick Windows into granting much higher permissions, potentially system-level control (the same level as the highest authority on the machine). Think of it like bypassing a locked door because the lock’s “measurement” is wrong.

Who is affected

This matters if you run Windows 10, Windows 11, or Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025). The issue is local and is most relevant for situations where an attacker can already run with low-level access (for example, after compromising an account, a service, or an app). It’s a risk when the attacker can interact with the NTFS processing locally under low privileges; the findings do not confirm whether it is reachable from the default configuration without local access.

How urgent is it

This is RED because it can turn low-level access into full system control on Windows machines, which is the kind of step attackers need to deploy ransomware or steal data effectively. Even though no CISA KEV listing or clear dated active exploitation report was provided here, the vulnerability has a security patch and is associated with new press/actor attention, so you should not wait for confirmation on your environment.

What to do — in detail

How to confirm exposure

On each Windows device/server, check the OS version/build (for example, via the Windows “About” page or standard inventory tools).
Compare the device’s current build to the fixed builds listed by Microsoft for CVE-2026-62880 below.
Prioritize devices where an attacker could realistically obtain low-level access (end-user laptops, systems with exposed services, or servers that run many apps).

Install the fixed update (by branch)

Upgrade to the fixed version that matches your Windows branch:

Windows 10
- fixed in 10.0.14393.9418
- fixed in 10.0.17763.9115
- fixed in 10.0.19044.7663
- fixed in 10.0.19045.7663
Windows 11
- fixed in 10.0.22631.7517
- fixed in 10.0.26100.9106
- fixed in 10.0.26200.9106
- fixed in 10.0.28000.2704
Windows Server 2016
- fixed in 10.0.14393.9418
Windows Server 2019
- fixed in 10.0.17763.9115
Windows Server 2022
- fixed in 10.0.20348.5440
Windows Server 2025
- fixed in 10.0.26100.33222
Windows Server 2012 / 2012 R2
- Confirm applicability against your exact build and Microsoft’s guidance for CVE-2026-62880; the provided fixed-version list does not include separate build numbers for 2012/2012 R2, so use the MSRC update guide to select the correct package for your build.

Verification

After patching, re-check the Windows build number.
Confirm the machine is at or above one of the fixed builds listed for its branch.

Workarounds if patching is delayed

Reduce the chance of “low-level access” being obtained: remove unnecessary local/admin privileges, tighten service permissions, and limit who can run code on the machine.
Restrict untrusted access paths (network isolation, reduce external exposure of services), since this is a local elevation issue.
Watch for suspicious behavior consistent with compromise escalation (for example, unusual process launches and unexpected privilege changes), and escalate incidents to your security response plan.

Monitor after update

Ensure update installation completes successfully across all endpoints.
For any machines that were not patched quickly, treat them as higher risk and increase monitoring until patched.

CISA due date

Not provided in the findings (KEV not listed).

Technical context

CVE-2026-62880 is a Windows NTFS local elevation-of-privilege vulnerability mapped to CWE-125 (out-of-bounds read). The reported mechanism is that an attacker with low-level privileges can trigger an out-of-bounds read in the NTFS file system to gain higher system permissions. Findings indicate no CISA KEV listing and no public exploit code on record; no clear dated active exploitation report was included. Patch availability is confirmed with fixed Windows build numbers across Windows 10/11 and multiple Windows Server versions via Microsoft’s MSRC update guide. The traffic-light verdict for this CVE is RED, reflecting the high impact (system-level control) if low-privilege access is achieved, even though confirmed widespread exploitation details were not provided in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable