Windows NTFS: Untrusted pointer dereference allows local code execution

Summary

An untrusted pointer dereference in the Windows NTFS file system driver allows an attacker with local access and high privileges to execute code on the affected system. The CVSS score is 6.7 (Medium), with high impact on confidentiality, integrity and availability. Because the attack requires an existing local account with high privileges, the risk is mainly post-compromise, but Windows 10 Version 1607 and Windows Server 2016 are in scope and should be checked first.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows Server 2016 (builds before 10.0.14393.9612)
• Further Windows 10, Windows 11 and Windows Server 2012/2012 R2 builds are listed in the CNA record; verify them against the MSRC advisory, as third-party mirrors disagree on some entries.

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 or later (per CNA record)
• KB number: Unknown.
• Fixed builds for other versions: see the CNA record and the MSRC advisory.

Workaround

Unknown. No Microsoft workaround was confirmed. A third-party source suggests restricting NTFS write permissions for non-privileged accounts, but this is unverified.

Exploitation

• Known exploitation: None known.
• CISA SSVC: Exploitation none, automatable no, technical impact total.
• Public proof of concept: None found in the research.
• CISA KEV: Not found in the research; check the KEV catalog directly.

Our recommendation

• Inventory all Windows 10 Version 1607 and Windows Server 2016 systems, including those with local user accounts.
• Install the cumulative update from Microsoft that contains the fix (10.0.14393.9612 or later) and confirm the KB number in the MSRC advisory.
• Check the Microsoft lifecycle page for Windows 10 Version 1607 and plan upgrades for systems that can no longer be patched.
• Reduce the number of local administrator accounts and restrict high privileges, as this lowers the risk from this CVE.
• Monitor for unusual privilege escalation or unexpected code execution on these systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-69902 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-69902 vulners.com
• OpenCVE: CVE-2026-69902 app.opencve.io
• CyberStrike: CVE-2026-69902 cyberstrike.io
• Microsoft customer risk cohort PDF 2026 cdn-dynmedia-1.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 00:53.