Windows NTFS CVE-2026-81971

Exploitation requires the attacker to already be an authenticated local user (PR:L) on the target Windows system with the ability to execute code that issues concurrent NTFS filesystem operations - no remote vector and no network exposure (AV:L). The key limiting factor is the race condition itself (AC:H): the attacker must repeatedly contend for a narrow timing window on shared NTFS resources, so exploitation is probabilistic and may require many attempts, and it is not automatable per CISA SSVC. No special non-default NTFS configuration is called out in the description; NTFS is the default filesystem, so any supported Windows edition below the fixed build (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761) is affected once local access is obtained.

This is a moderate-priority local privilege escalation in Windows NTFS that should be patched on a normal cycle rather than as an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms it requires local access and existing low-level privileges, and crucially carries AC:H - the hallmark of a race condition (CWE-362) where the attacker must win a timing window, making reliable exploitation non-trivial. All exploitation signals point away from urgency: SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and no public exploit identified at time of analysis - so no EPSS/POC pressure. The one aggravating signal is SSVC Technical Impact: total, consistent with the C:H/I:H/A:H impact and the fact that a successful NTFS race typically yields SYSTEM. The signals are therefore internally consistent: high potential impact but low current real-world exploitation likelihood and meaningful exploitation difficulty. Net: a genuine but not top-of-queue fix, primarily relevant as a post-compromise escalation primitive. Note: EPSS score was not provided in the input, so probabilistic exploitation likelihood could not be independently weighed.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing or a standard user account) runs a local tool that repeatedly triggers concurrent NTFS operations to win a timing window. Successfully exploiting the race condition corrupts shared filesystem state in a way that lets the attacker gain SYSTEM-level privileges. No public exploit code was identified, and the AC:H rating means the attacker likely needs many attempts to hit the race reliably.