CVE-2026-62880

NTFS is Windows’ main way of reading and organizing files. This vulnerability is a “how Windows checks file boundaries” bug—if an attacker can already get a foothold with low permissions, they can use a crafted file situation to trick Windows into granting much higher permissions, potentially system-level control (the same level as the highest authority on the machine). Think of it like bypassing a locked door because the lock’s “measurement” is wrong.

This matters if you run Windows 10, Windows 11, or Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025). The issue is local and is most relevant for situations where an attacker can already run with low-level access (for example, after compromising an account, a service, or an app). It’s a risk when the attacker can interact with the NTFS processing locally under low privileges; the findings do not confirm whether it is reachable from the default configuration without local access.

This is RED because it can turn low-level access into full system control on Windows machines, which is the kind of step attackers need to deploy ransomware or steal data effectively. Even though no CISA KEV listing or clear dated active exploitation report was provided here, the vulnerability has a security patch and is associated with new press/actor attention, so you should not wait for confirmation on your environment.