OS-WINDOWS Microsoft Windows NTFS remote code execution attempt

IPS-CFWIPS-SWG

3 SIDs: 65331, 65672, 66668

Description

Detects an attempt to exploit CVE-2025-54916, CVE-2026-20840, and CVE-2026-20922, a remote code execution flaw that can run code on the target in Microsoft Windows NTFS.

CVEs

CVE-2025-54916 CVE-2026-20840 CVE-2026-20922

Related malware families

Microsoft

References

msrc.microsoft.com
msrc.microsoft.com
msrc.microsoft.com