CVE-2023-36874
Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability
Description
CVE-2023-36874 is an elevation of privilege vulnerability in the Microsoft Windows Error Reporting Service that exploits an improper link resolution flaw (CWE-59) to allow a locally authenticated attacker to gain SYSTEM-level privileges. The Windows Error Reporting Service vulnerability affects a broad range of Microsoft Windows versions including Windows 10, Windows 11, and Windows Server editions from 2008 through 2022. By exploiting this vulnerability, an attacker with low-level access can escalate their privileges to gain full administrative control over the affected system. CISA has confirmed active exploitation of CVE-2023-36874 in the wild, and with an EPSS score of 71.2% (98th percentile), this vulnerability represents one of the most actively targeted privilege escalation flaws in the current threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20048 |
| microsoft | windows 10 1607 | < 10.0.14393.6085 |
| microsoft | windows 10 1809 | < 10.0.17763.4645 |
| microsoft | windows 10 21h2 | < 10.0.19041.3208 |
| microsoft | windows 10 22h2 | < 10.0.19045.3208 |
| microsoft | windows 11 21h2 | < 10.0.22000.2176 |
| microsoft | windows 11 22h2 | < 10.0.22621.1992 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.6085 |
| microsoft | windows server 2019 | < 10.0.17763.4645 |
| microsoft | windows server 2022 | < 10.0.20348.1850 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36874(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/174843/Microsoft-Error-Reporting-Local-Privilege-Elevation.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36874(US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access ('Link Following')
In CVE-2023-36874, the Windows Error Reporting Service fails to properly resolve file links (such as symbolic links or junction points) before performing privileged file operations. This allows an attacker to create a crafted link that redirects the service's file access to a location chosen by the attacker, resulting in unauthorized file manipulation with SYSTEM-level privileges.
Learn more: CWE-59 — Improper Link Resolution Before File Access ('Link Following')
Impact Analysis
CVE-2023-36874 carries a HIGH severity rating with a CVSS v3.1 score of 7.8, indicating substantial risk especially when combined with its high exploitation rate. The vulnerability requires local access to exploit, meaning the attacker must already have a foothold on the target system, and low privileges are required — a standard user account is sufficient. However, the attack complexity is low and no user interaction is needed, making exploitation straightforward once initial access is obtained. Successful exploitation delivers high impact across confidentiality, integrity, and availability, granting the attacker SYSTEM-level privileges that allow full control over the compromised machine, including reading all data, modifying system configurations, and disrupting services. The EPSS score of 71.2% (98th percentile) strongly indicates that this vulnerability is among the most actively exploited in the current threat landscape, demanding urgent remediation.
Exploit Maturity
Public exploit code is available for CVE-2023-36874 via Packet Storm Security, providing a functional local privilege escalation exploit. CISA has confirmed active exploitation in the wild by adding this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 1, 2023. The EPSS score of 71.2% places this vulnerability in the 98th percentile, indicating near-certain exploitation activity and underscoring the critical need for immediate patching.
Remediation
- Apply Microsoft security updates immediately as directed by CISA's KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Install the July 2023 Patch Tuesday updates from the Microsoft Security Update Guide.
- Prioritize patching across all affected Windows versions, including Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server (2008, 2012, 2016, 2019, 2022). Legacy systems running Windows Server 2008 or 2012 may require Extended Security Updates (ESU).
- Restrict access to the Windows Error Reporting Service by limiting which user accounts can interact with the service, disabling the service on systems where it is not required, and applying the principle of least privilege to reduce the attack surface for local privilege escalation.
- Monitor for exploitation indicators by auditing file system activity for suspicious symbolic link or junction point creation, reviewing Windows Error Reporting logs for anomalous behavior, and deploying endpoint detection rules that alert on privilege escalation attempts targeting WER components.
- Harden against link resolution attacks by enabling Windows security features that restrict symbolic link creation (such as the SeCreateSymbolicLinkPrivilege policy), implementing integrity-level-based access controls, and auditing directory permissions on paths used by the Windows Error Reporting Service.
Technical Details
CVE-2023-36874 exploits an improper link resolution vulnerability (CWE-59) in the Windows Error Reporting (WER) Service. The WER Service performs privileged file operations as SYSTEM, and the vulnerability arises because the service does not adequately validate file paths for symbolic links or junction points before accessing them. An attacker with low-level local access can create a crafted symbolic link that redirects the WER Service's file operations to an arbitrary location, enabling the attacker to write to or modify files with SYSTEM-level privileges. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is local with low complexity, requiring only low privileges and no user interaction, making it an ideal post-compromise escalation technique for attackers who have gained initial access through other means.
Frequently Asked Questions
Is CVE-2023-36874 being actively exploited?
Yes, CVE-2023-36874 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 1, 2023. Public exploit code is available via Packet Storm Security, and the EPSS score of 71.2% (98th percentile) confirms widespread exploitation activity.
What products are affected by CVE-2023-36874?
CVE-2023-36874 affects a wide range of Microsoft Windows versions. This includes Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server editions 2008, 2012, 2016, 2019, and 2022.
How do I fix CVE-2023-36874?
Apply the July 2023 security updates from Microsoft via the Microsoft Security Update Guide. As additional mitigation, restrict access to the Windows Error Reporting Service and limit symbolic link creation privileges. See the Remediation section for detailed steps.
How severe is CVE-2023-36874?
CVE-2023-36874 is rated HIGH severity with a CVSS v3.1 score of 7.8 out of 10. It ranks in the 98th percentile for exploitation probability (EPSS score of 71.2%), making it one of the most actively exploited privilege escalation vulnerabilities. Public exploit code is available, which significantly lowers the barrier for attackers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.