CVE-2023-36874: Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

CVE-2023-36874 is a privilege escalation vulnerability in the Microsoft Windows Error Reporting Service. It allows an attacker who already has some level of access on a Windows system to gain higher privileges. This matters because privilege escalation is a common step after initial compromise, enabling broader control of the host, persistence, or further movement in an environment. Public detail on exact mechanics is limited; confirm all specifics against the Microsoft vendor advisory.

The issue is tracked under CWE-59 and affects the Windows Error Reporting Service component. CISA describes it as an unspecified vulnerability that permits privilege escalation. Teams should treat any unpatched Windows systems running this service as potentially at risk until the vendor update is applied.

How it works

CWE-59 covers improper link resolution before file access, often called link following. In this class of flaw, software fails to correctly validate or resolve symbolic links, hard links, or similar redirections when accessing files or paths. An attacker with lower privileges can create or manipulate links so that a higher-privileged process (here, the Windows Error Reporting Service) operates on attacker-controlled locations instead of the intended ones.

Abuse typically involves placing a malicious link in a location the service will process, then triggering the service so that it performs privileged file operations under the attacker's influence. The result is elevation of privileges on the local system. Exact trigger conditions, required access levels, and exploitation steps are not detailed in the available summary; treat them as unspecified and verify against the Microsoft advisory rather than assuming particular techniques.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows systems that include the Windows Error Reporting Service. This service is present by default on most modern Windows client and server editions and is used for collecting and submitting crash and error data.

Inventory steps:

• Query asset management, SCCM/Intune, or endpoint agents for Windows hosts and confirm the presence of the Windows Error Reporting Service (commonly visible as WerSvc).
• Check installed Windows versions and patch levels against the Microsoft security update that addresses CVE-2023-36874; exact build numbers and KB articles must be confirmed in the vendor advisory.
• Review configurations that leave the Error Reporting Service enabled or that allow non-privileged users to interact with its working directories or queues.

For signs of exploitation, look for unusual process activity under the Error Reporting Service identity, unexpected file or link creation in temporary or system directories associated with error reporting, or privilege-elevation events that coincide with WerSvc activity. Standard Windows security logs, Sysmon, and EDR telemetry for process creation, file operations, and token elevation can surface anomalies, but no unique indicators are provided in the public summary. Correlate any findings with the Microsoft advisory for confirmation.

How to remediate

Apply the Microsoft security update that remediates CVE-2023-36874 as the primary action. Follow the vendor instructions for deployment, testing, and reboot requirements. CISA directs organizations to apply updates per vendor instructions or to discontinue use of the product if updates are unavailable.

After patching, harden the Error Reporting Service and related components:

• Ensure the service runs with least privilege and that its working directories have restrictive ACLs that prevent untrusted users from creating links or writing files.
• Disable unnecessary error-reporting features if they are not required for operations.
• Keep Windows fully updated and maintain a regular patch cadence for the Error Reporting components.

Validate remediation by confirming the relevant update is installed and by re-checking service configurations against the advisory guidance.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Segment high-value systems so that local privilege escalation has limited blast radius; restrict lateral movement paths from endpoints that still run the vulnerable service.
• Use application control or endpoint protection policies to limit which processes can interact with Error Reporting paths and to block creation of symbolic or hard links in sensitive locations where feasible.
• If the service is not required, disable the Windows Error Reporting Service after assessing operational impact.
• Increase monitoring and alerting on WerSvc process activity, unexpected privilege elevations, and file-system link operations; feed these into your SIEM or EDR for rapid investigation.
• Consider host-based or network virtual patching only if your security tools provide a specific signature or rule for this CVE; otherwise rely on the general controls above and prioritize the official patch.

These measures lower risk but do not eliminate it; schedule the official update as soon as possible.

If your data may have been exposed

Actively exploited privilege-escalation vulnerabilities can lead to full host compromise and subsequent data exposure or ransomware deployment, although ransomware use is not documented for this CVE. If you suspect exploitation, isolate affected systems, preserve forensic evidence, and follow your incident-response plan. Review accounts, scheduled tasks, and persistence mechanisms that may have been created with elevated privileges. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data to see whether credentials or personal information have appeared in prior incidents.