CVE-2023-36874: Windows Error Reporting Service local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with confirmed exploitation and a high EPSS score, but it requires an existing local foothold rather than being remotely reachable.

What it is

The Windows Error Reporting Service contains a link-following flaw (CWE-59) that lets a local user elevate privileges. Microsoft rates it 7.8 HIGH, and CISA added it to the Known Exploited Vulnerabilities catalog, so it is being used in real attacks.

Impact

An attacker who already has a low-privileged foothold gains full control of confidentiality, integrity and availability on the host, effectively SYSTEM-level access.

Attack surface

The vector is local (AV:L), requires low privileges (PR:L) and no user interaction (UI:N), so the attacker must already be able to run code on the machine and then triggers the Error Reporting Service.

Exploitation

CISA KEV lists it as exploited with a 2023-08-01 remediation deadline, and EPSS is 0.434 (98.7th percentile); a public exploit is referenced on Packet Storm.

What to do

• Apply the Microsoft July 2023 security updates for all listed Windows 10, Windows 11 and Windows Server versions.
• If a system cannot be patched, follow CISA guidance and discontinue use of the affected product.
• Restrict local interactive logon and code execution rights to reduce the low-privileged foothold the exploit needs.
• Monitor and, where feasible, disable or tightly control the Windows Error Reporting Service on high-value hosts.

Detection

• Alert on unexpected child processes or service creation spawned by WerFault.exe or the Windows Error Reporting service.
• Watch for file or directory link creation in paths the Error Reporting Service writes to, especially before a privilege change.
• Correlate local low-privilege process activity with subsequent SYSTEM-level process or token creation on the same host.
• Hunt for known public exploit artifacts tied to CVE-2023-36874 in EDR telemetry and file system logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.