Actively exploited · Published Jul 11, 2023 · Assigned by microsoft
CVE-2023-36874Windows Error Reporting Service Elevation of Privilege Vulnerability
High 7.8 Exploited
In plain English
A high-severity security flaw in Windows 10 Version 1507 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on July 11, 2023). The chance it is exploited in the next 30 days is estimated at 42.6% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CISA guidance
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Federal agencies must remediate by Aug 1, 2023.
Official description
Windows Error Reporting Service Elevation of Privilege Vulnerability
Affected products (as reported)
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References
- Windows Error Reporting Service Elevation of Privilege Vulnerability vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36874 government-resource
- http://packetstormsecurity.com/files/174843/Microsoft-Error-Reporting-Local-Privilege-Elevation.html x_transferred