Windows NTFS CVE-2026-69379

The attacker must hold a low-privileged local user account on the target system - unauthenticated remote exploitation is not possible. High attack complexity (AC:H) reflects a race condition or precise environmental setup (junction placement, timing of a privileged file operation) that limits reliable exploitation and resists automation. The vulnerability is constrained to Windows 11 versions 23H2, 24H2, 25H2, 26H1, and Windows Server 2025; systems running Windows 10 or Windows Server 2022/2019 are not listed as affected. No user interaction from a privileged account is required once the attacker has local access. The ability to create NTFS directory junctions (a standard user capability) is sufficient as a precondition; full symbolic link creation privileges are not required.

CVSS 7.0 with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H places this as a high-severity local escalation, but AC:H is a meaningful constraint: the race condition or symlink setup requires precise timing or environmental conditions not trivially automated. Full C:H/I:H/A:H impact indicates complete system compromise on successful exploitation. No CISA KEV listing and no POC data are provided, so no confirmed active exploitation exists at time of analysis. EPSS data is absent from the input. The realistic defender priority is patch within the next scheduled maintenance cycle rather than emergency out-of-band response, unless environments host many untrusted low-privilege users (shared terminal servers, VDI pools, cloud-hosted Windows instances with user-accessible logins) where the attack surface is meaningfully elevated. The scope of affected products is limited to Windows 11 (four release branches) and Windows Server 2025 - older Windows 10 and Server 2022/2019 are not listed, so patch urgency is concentrated in newer deployments.

A low-privileged user on a Windows 11 24H2 system creates an NTFS directory junction pointing from a temp directory to a sensitive system path such as a protected DLL directory. When a scheduled SYSTEM-level NTFS maintenance or file operation traverses the temp path, the driver follows the junction and the attacker's process races to intercept or manipulate the I/O, overwriting a DLL loaded by a SYSTEM service or reading a protected credential store - achieving code execution as SYSTEM on the next service restart. No public POC has been identified.