A recently discovered vulnerability, CVE-2023-36874, poses a high severity risk to various versions of Microsoft Windows 10, Windows 11, and Windows Server systems. This vulnerability, found in the Windows Error Reporting Service, could allow an attacker to escalate their privileges on a system, potentially leading to unauthorized access and control. It is crucial for users and administrators to stay informed and apply necessary security updates to protect their systems from potential exploitation.

How do I know if I'm affected?

If you're using Microsoft Windows 10, Windows 11, or Windows Server, you might be affected by the CVE-2023-36874 vulnerability. This issue is present in various versions of these operating systems, including Windows 10 1507 to 22h2, Windows 11 21h2 to 22h2, and Windows Server 2008 to 2022. To know if you're affected, check your system's version and compare it to the list of affected versions. Keep in mind that successfully exploiting this vulnerability could allow an attacker to gain administrator privileges on your system.

What should I do if I'm affected?

If you're affected by the this vulnerability, it's important to take action to protect your system. First, check for available security updates from Microsoft and install them. Next, ensure your system is running the latest version of Windows or Windows Server. Finally, stay informed about new vulnerabilities and follow best practices for system security, such as using strong passwords and keeping software up-to-date.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-36874 vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, known as the Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability, was added to the catalog on July 11, 2023. Organizations are required to take action by August 1, 2023, either by applying updates according to vendor instructions or discontinuing the use of the affected product if updates are unavailable.

Weakness enumeration

The weakness enumeration for this vulnerability is "Insufficient Information", indicating a lack of specific details about the vulnerability and its mitigation. However, it's an elevation of privilege issue affecting various Windows and Windows Server versions. Remediation involves installing security updates provided by Microsoft.

For more details

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• Microsoft Error Reporting Local Privilege Elevation - Packet Storm

• CVE-2023-36874 - Security Update Guide - Microsoft

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities - CISA

• Known Exploited Vulnerabilities Catalog - Cybersecurity & Infrastructure Security Agency