CVE-2026-77503 is a high severity (CVSS 8.4) local privilege escalation flaw in Windows NTFS. The fix is the September 2026 Windows security update. Microsoft has not marked it as exploited at release, and the CISA KEV flag is false. Check the MSRC entry for your exact build.
What's affected
Windows NTFS. The record lists the affected product families, and Microsoft's September 2026 update data lists the specific builds and the update (KB) number for each. Microsoft's data lists the customer action as required, so the fix is a normal security update.
The record lists Windows 10 versions 1607, 1809, 21H2 and 22H2 and Windows 11 versions 23H2, 24H2, 25H2 and 26H1.
Microsoft's data marks the issue as not publicly disclosed and not exploited at release, with an exploitability assessment of Exploitation Less Likely. The record's KEV flag is false. An assessment of this kind can change, so recheck the entry if the issue matters to you.
How to check if you're exposed
Check which update level the machine is on.
winver
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Microsoft's data lists KB5122876 among the updates for several Windows versions in this release, but the update number differs by Windows version, so confirm yours in the MSRC entry. To check for one KB, run Get-HotFix with the id parameter. Your endpoint management tool can report the same across the fleet.
What to do now
- Open the Microsoft update guide entry and find the update that applies to your exact build.
- Deploy the September 2026 security update through your normal patch process, test group first, then broad rollout.
- Confirm the update installed on a sample of machines, then report coverage across the fleet.
- Prioritise shared machines, jump hosts and servers where untrusted users can log on, since a local escalation matters most there.
Why it matters
The weakness is CWE-125, out-of-bounds read. NTFS is the file system driver, so it runs with the highest privileges. An out-of-bounds read means the code reads memory past the end of a buffer. In kernel components, that can expose data that helps an attacker or can be combined with other steps to take control. Microsoft rates the result as high on confidentiality, integrity and availability, with no user interaction and low complexity, but it needs local access.
The published description is a single sentence, and Microsoft does not add technical detail for most of these issues. That is typical, and it is the reason to judge risk by exposure: who can reach the vulnerable component, and how fast you can patch it. A local attacker with a foothold on a machine is the audience for this bug.
Quick check
Can someone attack this over the network?
The record's attack vector is local, so the attacker needs to run code or log on to the machine first.
Is it exploited?
Microsoft's release data says not exploited, and the KEV flag in the record is false.
Sources
Last reviewed: 18 October 2026.
