Abstract illustration of connected devices separated by a protected security boundary.
Microsoft has released fixes for CVE-2026-69461, Windows NTFS Remote Code Execution Vulnerability, an Important-rated flaw in the Windows NTFS file system that can allow an unauthorized attacker to execute code over a network. The practical trigger is narrower than the network attack vector alone suggests: Microsoft’s advisory says a user must open a specially crafted file supplied by the attacker to initiate remote code execution.

The Microsoft Security Response Center rates the vulnerability 8.8 on the CVSS base scale and 7.7 under its temporal score. Its full vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C; the weakness is classified as CWE-121, a stack-based buffer overflow. Microsoft’s assessment is Exploitation Less Likely, but the company has marked customer action as required.

Publicly disclosed: No

Exploited: No

Customer action required: Yes

NTFS parsing is the attack surface​

Microsoft describes CVE-2026-69461 as a stack-based buffer overflow in Windows NTFS that allows an unauthorized attacker to execute code over a network. NTFS is Windows’ default file system on the affected client and server releases, so the corrective updates matter across workstations, Server Core deployments, and full server installations.

The advisory’s user-interaction requirement is operationally important. An attacker does not get remote code execution merely by reaching a machine across the network; Microsoft says the target must open a specially crafted file from the attacker. That places this flaw in the path of file-delivery attacks, including files presented through shared locations or other channels where a recipient can be persuaded to open content.

The CVSS vector records network attack vector, low attack complexity, no privileges required, required user interaction, unchanged scope, and high impact to confidentiality, integrity, and availability. The resulting 8.8 base score reflects what can happen after the crafted file is opened, rather than a claim that every reachable NTFS machine can be compromised without an end-user action.

Microsoft’s published risk assessment​

Microsoft’s official advisory identifies the issue as “Windows NTFS Remote Code Execution Vulnerability: Stack-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code over a network.” The advisory also explicitly explains the target context: “This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.”

Administrators should read “Exploitation Less Likely” as Microsoft’s current assessment, not as a mitigation. The vendor has provided fixes across a long range of Windows versions and has explicitly set Customer action required: Yes. Patch deployment and post-install build verification are therefore the documented response.

Windows 10 and Windows 11 fixed builds​

For Windows client fleets, the relevant deployment target is the cumulative update and its resulting build, with architecture-specific product entries sharing the same KB where Microsoft lists them together.

  • For Windows 10 Version 1607 for 32-bit Systems (x86), install KB5123099 to reach fixed build 10.0.14393.9512.
  • For Windows 10 Version 1607 for x64-based Systems, install KB5123099 to reach fixed build 10.0.14393.9512.
  • For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5122876 to reach fixed build 10.0.17763.9245.
  • For Windows 10 Version 1809 for x64-based Systems, install KB5122876 to reach fixed build 10.0.17763.9245.
  • For Windows 10 Version 21H2 for 32-bit Systems (x86), install KB5122878 to reach fixed build 10.0.19044.7725.
  • For Windows 10 Version 21H2 for ARM64-based Systems, install KB5122878 to reach fixed build 10.0.19044.7725.
  • For Windows 10 Version 21H2 for x64-based Systems, install KB5122878 to reach fixed build 10.0.19044.7725.
  • For Windows 10 Version 22H2 for 32-bit Systems (x86), install KB5122878 to reach fixed build 10.0.19045.7725.
  • For Windows 10 Version 22H2 for ARM64-based Systems, install KB5122878 to reach fixed build 10.0.19045.7725.
  • For Windows 10 Version 22H2 for x64-based Systems, install KB5122878 to reach fixed build 10.0.19045.7725.
  • For Windows 11 Version 23H2 for ARM64-based Systems, install KB5122880 to reach fixed build 10.0.22631.7582.
  • For Windows 11 Version 23H2 for x64-based Systems, install KB5122880 to reach fixed build 10.0.22631.7582.
  • For Windows 11 Version 24H2 for ARM64-based Systems, install KB5124008 to reach fixed build 10.0.26100.9445.
  • For Windows 11 Version 24H2 for x64-based Systems, install KB5124008 to reach fixed build 10.0.26100.9445.
  • For Windows 11 Version 25H2 for ARM64-based Systems, install KB5124008 to reach fixed build 10.0.26200.9445.
  • For Windows 11 Version 25H2 for x64-based Systems, install KB5124008 to reach fixed build 10.0.26200.9445.
  • For Windows 11 Version 26H1 for ARM64-based Systems, install KB5124012 to reach fixed build 10.0.28000.2954.
  • For Windows 11 version 26H1 for x64-based Systems, install KB5124012 to reach fixed build 10.0.28000.2954.

Windows Server fixed builds​

Microsoft’s affected-product record includes both Server Core and full-installation entries. Server Core systems need the applicable update just as full GUI installations do; the management interface does not alter the NTFS component addressed by this advisory.

  • For Windows Server 2012 (Server Core installation) (x64), install KB5123065 to reach fixed build 6.2.9200.26349.
  • For Windows Server 2012 (x64), install KB5123065 to reach fixed build 6.2.9200.26349.
  • For Windows Server 2012 R2 (Server Core installation) (x64), install KB5123066 to reach fixed build 6.3.9600.23397.
  • For Windows Server 2012 R2 (x64), install KB5123066 to reach fixed build 6.3.9600.23397.
  • For Windows Server 2016 (Server Core installation) (x64), install KB5123099 to reach fixed build 10.0.14393.9512.
  • For Windows Server 2016 (x64), install KB5123099 to reach fixed build 10.0.14393.9512.
  • For Windows Server 2019 (Server Core installation) (x64), install KB5122876 to reach fixed build 10.0.17763.9245.
  • For Windows Server 2019 (x64), install KB5122876 to reach fixed build 10.0.17763.9245.
  • For Windows Server 2022 (Server Core installation) (x64), install KB5122882 to reach fixed build 10.0.20348.5622.
  • For Windows Server 2022 (x64), install KB5122882 to reach fixed build 10.0.20348.5622.
  • For Windows Server 2025 (Server Core installation) (x64), install KB5122871 to reach fixed build 10.0.26100.33438.
  • For Windows Server 2025 (x64), install KB5122871 to reach fixed build 10.0.26100.33438.

Deployment should verify the resulting build​

The immediate administrative task is to identify affected Windows versions and architectures, deploy the matching KB, and confirm that each endpoint or server reaches Microsoft’s stated fixed build. This is particularly relevant where update rings, servicing tools, or reboot scheduling can leave devices with a successfully downloaded package but an unfinalized installation.

Because the vulnerability requires a user to open attacker-crafted content, organizations should also reinforce normal file-handling controls while updates are being rolled out. The durable remediation, however, is the Microsoft update level listed above: systems that remain below the relevant fixed build have not reached the version Microsoft identifies for CVE-2026-69461.

 

Click to expand...
You must log in or register to reply here.