In short: Positive Technologies researcher Sergey Tarasov discovered three vulnerabilities in the Windows NTFS file system driver affecting 30 Windows versions — including Windows 10, 11, and server editions through Windows Server 2025. The most critical flaw, CVE-2026-50494 (CVSS 7.8), enables arbitrary code execution and full system takeover: all an attacker needs is to trick the victim into opening a crafted VHD file. Around 40 million computers in Russia are potentially at risk. Microsoft shipped patches on August 12, 2026.
What Happened
On August 11, 2026, Positive Technologies published details of three vulnerabilities in the Windows NTFS driver — the standard file system component shipped with every version of Windows. The researcher is Sergey Tarasov. The flaws carry identifiers CVE-2026-50471, CVE-2026-50494, and CVE-2026-58640. All were disclosed responsibly, and Microsoft patched them in the August 2026 Patch Tuesday cycle. For other security stories from this period, see the LiMP VPN security news section.
NTFS is not just a file format — it is a privileged kernel-mode driver. A bug at this level means default full system compromise at SYSTEM privileges.
Why a VHD File Is the Perfect Attack Vector
A VHD (Virtual Hard Disk) is a standard Windows disk image format. Double-clicking a VHD file prompts Windows Explorer to mount it as a drive. At that exact moment, Windows calls the NTFS driver — and a malicious image can execute arbitrary code at kernel privilege level.
The attacker does not need a password, a phishing site, or an EDR bypass. Sending the target a VHD email attachment or a download link is enough — one double-click and the machine is fully compromised. A similar one-file exploit chain was previously documented in the Windows Shell NTLM leak vulnerability we covered earlier.
Three Vulnerabilities: Details and Severity
All three bugs reside in the same component — the ntfs.sys driver:
- CVE-2026-50494 (CVSS 7.8) — the most critical. Enables arbitrary code execution and complete system takeover. Opening a crafted VHD runs malicious code at kernel level, bypassing antivirus tools and granting SYSTEM-level privileges.
- CVE-2026-50471 (CVSS 7.8) — a second code execution path. An independent exploitation vector through VHD at the same severity level. Two separate attack paths mean patching one does not fully remove the risk.
- CVE-2026-58640 (CVSS 7.3) — security feature bypass. Enables attackers to conceal malicious activity from security tools by intercepting and filtering file system calls before they reach monitoring software.
Together, the three vulnerabilities deliver a complete attacker toolkit in a single VHD file: initial access, code execution, and active evasion of detection.
Scale: 40 Million PCs in Russia at Risk
Positive Technologies, citing Rosstat and Statcounter data, estimates approximately 40 million computers in Russia run affected Windows versions: Windows 10, 11, and Windows Server 2016 through 2025. The server editions on the list extend the threat to corporate infrastructure — file servers and virtualization platforms that routinely process VHD images are high-value targets that remain exposed until patched. Encrypting network traffic with a VPN reduces one exposure surface, but this vulnerability requires an OS-level fix first.
What to Do Right Now
- Install the Microsoft August 2026 security update. Available via Windows Update: Start → Settings → Windows Update → Check for updates. A reboot is required after installation — the NTFS driver loads at system startup.
- Do not open VHD or VHDX files from untrusted sources. A disk image in an email attachment, a VHD download link in a message, or a file from an unknown sender are all potential attack vectors until the patch is installed.
- In corporate environments, restrict VHD mounting via Group Policy. Preventing non-administrative users from mounting virtual disk images significantly reduces the attack surface across multiple machines simultaneously.
- Encrypt your network connections. A VPN does not fix CVE-2026-50494 — that is a code-level bug, not a network one. But LiMP VPN encrypts your traffic and prevents attackers on intermediate network nodes from delivering malicious VHD files over unprotected HTTP connections or public Wi-Fi networks.