Microsoft Windows NTFS: Time-of-check time-of-use race condition allows tampering

Summary

A time-of-check time-of-use (TOCTOU) race condition in the NTFS file system of Microsoft Windows allows an authorized local user to tamper with data. The attacker needs a low-privilege local account and must win a timing race, which makes exploitation harder. Microsoft rates the severity as Important and exploitability as Unproven, and no exploitation or public proof of concept is known.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2, 26H1, 26H2: listed as affected in the CNA record; fixed builds unknown in the sources
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822

Fixed in

• Install the November 2026 cumulative update for each affected product (advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102200).
• Exact fixed build numbers should be verified in the MSRC Security Update Guide; some third-party sources conflict.

Workaround

Unknown. No workaround or mitigation was found in the sources.

Exploitation

• Microsoft rates exploitability as Unproven.
• CISA SSVC: exploitation none, not automatable, partial technical impact.
• Not listed in CISA KEV according to one source.
• No exploitation in the wild and no public proof of concept reported as of 11 November 2026.

Our recommendation

• Install the November 2026 cumulative update through the normal monthly patch cycle; this is not an emergency.
• Prioritise file servers, shared systems and multi-user terminal servers.
• Limit local logon on servers and shared systems to trusted accounts.
• Review sensitive file permissions as general hardening.
• Check your ESU status if Windows 10 22H2 is still in use.
• Re-check NVD and MSRC for changes to the exploitability rating.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-102200 msrc.microsoft.com
• CVE Record CVE-2026-102200 www.cve.org
• Microsoft CVRF November 2026 api.msrc.microsoft.com
• Strix CVE-2026-102200 www.strix.ai
• OpenCVE CVE-2026-102200 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:00.