CVE-2024-26169
Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability
Description
CVE-2024-26169 is a high-severity elevation of privilege vulnerability in the Windows Error Reporting Service that affects virtually all supported versions of Windows, from Windows 10 through Windows Server 2022. A locally authenticated attacker with low privileges can exploit this flaw to gain SYSTEM-level access. With a CVSS v3.1 score of 7.8, this vulnerability is notable for its confirmed use in ransomware campaigns. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 4, 2024 and marked its ransomware association as Known. The EPSS score of 35.15% at the 96.9th percentile places it among the top 3% of vulnerabilities by exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20526 |
| microsoft | windows 10 1607 | < 10.0.14393.6796 |
| microsoft | windows 10 1809 | < 10.0.17763.5576 |
| microsoft | windows 10 21h2 | < 10.0.19044.4170 |
| microsoft | windows 10 22h2 | < 10.0.19045.4170 |
| microsoft | windows 11 21h2 | < 10.0.22000.2836 |
| microsoft | windows 11 22h2 | < 10.0.22621.3296 |
| microsoft | windows 11 23h2 | < 10.0.22631.3296 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | < 10.0.17763.5576 |
| microsoft | windows server 2022 | < 10.0.20348.2333 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.763 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26169(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-26169(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2024-26169. The vulnerability resides in the Windows Error Reporting (WER) Service, where a flaw allows a locally authenticated user to escalate privileges to SYSTEM. The Windows Error Reporting Service runs with elevated privileges to collect and transmit crash data, and vulnerabilities in this service typically involve improper handling of file operations, symbolic links, or access controls that allow a low-privileged user to hijack the service's elevated execution context.
Impact Analysis
CVE-2024-26169 allows a local attacker with standard user privileges to gain SYSTEM-level access through the Windows Error Reporting Service. The CVSS vector indicates a Local attack (AV:L) with Low complexity (AC:L) and Low privileges required (PR:L), meaning exploitation is straightforward once the attacker has any form of local access. Confidentiality (High): SYSTEM-level access grants the attacker unrestricted read access to all files, registry keys, credentials, and secrets on the system. Integrity (High): the attacker can modify any file, install persistent backdoors, alter security configurations, disable security software, and create new administrative accounts. Availability (High): the attacker can disrupt any service, encrypt files for ransom, or render the system completely inoperable. The critical distinguishing factor for CVE-2024-26169 is its confirmed ransomware association. CISA has marked the ransomware status as Known, meaning this vulnerability is actively used in ransomware kill chains. The EPSS score of 35.15% at the 96.9th percentile confirms extremely high exploitation probability. The breadth of affected systems spanning Windows 10, Windows 11, and all Windows Server editions from 2008 through 2022 makes this vulnerability a top-priority remediation target for every Windows environment.
Exploit Maturity
CVE-2024-26169 has a highly mature exploit landscape with confirmed use in ransomware operations. CISA added it to the KEV catalog with a remediation deadline of July 4, 2024 and explicitly marked its ransomware association as Known, confirming that ransomware groups are actively leveraging this vulnerability. The EPSS score of 35.15% at the 96.9th percentile places it in the top 3% of all CVEs by exploitation probability. Microsoft released the security update as part of the March 2024 Patch Tuesday cycle, documented at the Microsoft Security Response Center advisory. The gap between patch availability (March 2024) and the CISA KEV deadline (July 2024) indicates that many organizations were slow to patch, giving ransomware operators an extended exploitation window. The combination of SYSTEM-level privilege escalation, low complexity, and broad Windows version coverage makes this vulnerability an ideal component in ransomware deployment chains.
Remediation
-
Apply the March 2024 Microsoft security update immediately across all affected Windows systems. This vulnerability is confirmed in ransomware operations, making it one of the highest-priority patches for any Windows environment. Refer to the Microsoft Security Response Center advisory for specific KB article numbers.
-
Prioritize patching based on exposure by focusing first on systems accessible to external users or systems that process untrusted content. Servers in DMZ environments, terminal servers, and workstations with internet access should be patched before isolated internal systems.
-
Verify patch deployment across all affected versions including Windows 10 (1507 through 22H2), Windows 11 (21H2, 22H2, 23H2), Windows Server 2008, 2012, 2016, 2019, 2022, and Windows Server 2022 23H2. Use vulnerability scanning tools to confirm that all systems have the appropriate KB installed.
-
Deploy endpoint detection and response (EDR) rules to detect exploitation of the Windows Error Reporting Service. Monitor for unexpected SYSTEM-level process creation originating from WER processes, unusual file operations in WER directories, and anomalous service behavior patterns.
-
Implement ransomware-specific defenses including network segmentation, offline backup verification, application whitelisting, and restricted administrative access. Since this vulnerability is confirmed in ransomware operations, defense-in-depth against ransomware is critical even after patching.
Technical Details
CVE-2024-26169 is an elevation of privilege vulnerability in the Windows Error Reporting Service with a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding a score of 7.8 (High). The Attack Vector is Local (AV:L), requiring the attacker to have local access to the target system. Attack Complexity is Low (AC:L), meaning no special conditions are needed. Privileges Required is Low (PR:L), so any standard user account is sufficient. User Interaction is None (UI:N), and the Scope is Unchanged (S:U). All three impact metrics are rated High, granting complete system compromise. The Windows Error Reporting Service (wersvc) is a built-in Windows service that runs as SYSTEM and is responsible for collecting and submitting crash reports. The vulnerability exists in how the WER service handles certain operations, allowing a low-privileged user to manipulate the service into performing privileged actions on their behalf. This type of privilege escalation is characteristic of service-based EoP vulnerabilities where the service's SYSTEM context is hijacked through improper validation of user-controlled inputs or file operations. The affected systems span the entire supported Windows ecosystem from Windows 10 1507 (build < 10.0.10240.20526) through Windows Server 2022 23H2 (build < 10.0.25398.763), including legacy Server 2008 and 2012.
Frequently Asked Questions
Is CVE-2024-26169 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2024-26169 to the KEV catalog. More critically, CISA has marked the ransomware association as "Known," confirming that ransomware groups are actively using this vulnerability in their attack chains.
Is CVE-2024-26169 used in ransomware attacks?
Yes. CISA has explicitly confirmed a known ransomware association for CVE-2024-26169. This vulnerability provides SYSTEM-level privilege escalation, which is a critical step in ransomware deployment, allowing attackers to disable security tools, encrypt files across the system, and establish persistence.
What systems are affected by CVE-2024-26169?
Virtually all supported Windows versions are affected, including Windows 10 (1507 through 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server (2008, 2012, 2016, 2019, 2022, and 2022 23H2). The Windows Error Reporting Service is a core Windows component present on all installations.
How do I fix CVE-2024-26169?
Apply the March 2024 security update from Microsoft. The patch is available through Windows Update, WSUS, and the Microsoft Update Catalog. Given the confirmed ransomware association, this should be treated as an emergency patching priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.