Privilege Escalation in Microsoft Windows Error Reporting Service (CVE‑2023‑36874)
What It Is – An unspecified flaw in the Windows Error Reporting (WER) service allows a low‑privileged user to elevate to SYSTEM level on affected Windows installations.
Exploitability – Publicly disclosed; no public exploit code, but the vulnerability is rated High (CVSS ≈ 7.8) and could be weaponized by an attacker with local access.
Affected Products – Microsoft Windows 10, Windows Server 2016‑2022 (all editions that include the WER service).
Why It Matters for Trust & Control Assurance
- Privileged‑access controls: The flaw bypasses the principle of least privilege, a core control objective that underpins many frameworks (e.g., NIST CSF Identify‑Protect).
- Continuous monitoring: Detecting unexpected privilege escalations requires robust logging and real‑time analytics—evidence that an organization is actively managing its attack surface.
- Audit readiness: Demonstrating that critical OS components are patched and that privileged‑access policies are enforced provides defensible proof for auditors and enterprise buyers.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2023‑36874 on all Windows endpoints and servers.
- Verify patch compliance through automated inventory tools; remediate any gaps immediately.
- Review and tighten privileged‑access policies (e.g., restrict local admin rights, enforce Just‑In‑Time elevation).
- Enable detailed logging for WER service activity and integrate alerts into your SIEM.
Source: CISA KEV – CVE‑2023‑36874