CVE-2019-0863: Windows Error Reporting Elevation of Privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe vulnerability is in CISA KEV, has a high CVSS score (7.8), and affects a wide range of Windows systems, though it requires local access and low privileges.

What it is

Windows Error Reporting (WER) mishandles files, allowing a local user to escalate privileges. The flaw affects a broad range of Windows client and server versions, and Microsoft addressed it with a security update. Because WER is a core Windows component, the issue is relevant to any unpatched host.

Impact

An attacker who successfully exploits this vulnerability gains elevated privileges on the affected system, potentially up to SYSTEM. This can lead to full control of the host, including data access, persistence, and further lateral movement.

Attack surface

The vulnerability is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N). An attacker must already have code execution or an interactive session on the target machine to trigger the flaw.

Exploitation

CVE-2019-0863 is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. EPSS shows a 30-day probability of about 5.2% (92nd percentile), and public exploit code is referenced via Packet Storm.

What to do

• Apply the Microsoft security update for CVE-2019-0863 on all affected Windows versions as soon as possible.
• Prioritize patching for systems that allow local interactive logon or remote code execution by non-administrative users.
• Restrict local logon and execution rights to only trusted users and applications to reduce the attack surface.
• Monitor for and remove unnecessary local user accounts or software that could be used to trigger WER file handling.
• Verify patch deployment using vulnerability scanning or endpoint management tools.

Detection

• Monitor for unusual process creation where werfault.exe or related WER processes spawn child processes with elevated privileges.
• Audit file system changes in WER directories (e.g., %ProgramData%\Microsoft\Windows\WER) for suspicious file creation or modification.
• Enable and review Windows Event Logs for privilege escalation attempts, such as Event ID 4672 (special privileges assigned) or anomalous token manipulation.
• Use endpoint detection and response (EDR) to flag known exploit patterns or tools associated with this vulnerability.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.