NTFS Link Following Local Tampering Vulnerability

Publication date: 2026-09-08

Last updated on: 2026-09-14

Assigner: Microsoft Corporation

Description

Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform tampering locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-14

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-69425

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_11_23h2	to 10.0.22631.7582 (exc)
microsoft	windows_11_23h2	to 10.0.22631.7582 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9445 (exc)
microsoft	windows_11_24h2	to 10.0.26100.9445 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9445 (exc)
microsoft	windows_11_25h2	to 10.0.26200.9445 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2954 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2954 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This is a link following vulnerability in Windows NTFS where an authorized attacker can manipulate file paths to access or tamper with files they should not be able to. It allows local privilege escalation or unauthorized file modifications by exploiting improper path resolution before file access.

Impact Analysis

An attacker with local access could modify sensitive files, install malware, or escalate privileges to gain control over the system. This could lead to data theft, system corruption, or unauthorized access to other user accounts on the machine.

Mitigation Strategies

Apply the latest Windows security updates from Microsoft to patch the NTFS vulnerability. Ensure proper access controls are in place to limit unauthorized local modifications. Monitor system logs for suspicious file access or tampering attempts.

Hi! I’m here to help you understand CVE-2026-69425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70