Loading story…
Researchers disclosed CVE-2026-20817, a local privilege escalation flaw in the Windows Error Reporting (WER) service that allows a low-privileged user to obtain SYSTEM privileges by sending a crafted ALPC message to \WindowsErrorReportingServicePort. The bug resides in WerSvc.dll and affects the SvcElevatedLaunch code path, where user-controlled data from a file-mapping-backed buffer can be passed as command-line arguments when the service launches WerFault.exe with CreateProcessAsUserW under SYSTEM context.
Patch analysis showed Microsoft mitigated the issue by effectively disabling the vulnerable SvcElevatedLaunch feature rather than rewriting the logic, with the patched path returning 0x80004005 (E_FAIL). Researchers produced a proof of concept demonstrating SYSTEM-context WerFault.exe execution with attacker-controlled arguments, although full arbitrary code execution would require additional Windows internals techniques; they also noted operational constraints such as the WER service needing to be running and possible Microsoft Defender detection because the behavior resembles parent process ID spoofing. Reports further warned that fake and potentially malicious GitHub proof-of-concept repositories for CVE-2026-20817 are already circulating.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting highlighted that potentially malicious fake proof-of-concept repositories for CVE-2026-20817 had appeared on GitHub after public disclosure of the vulnerability details. The warning accompanied broader coverage of the exploit mechanics and Microsoft's mitigation approach.
A researcher published patch analysis and exploitation details for CVE-2026-20817, showing how crafted messages sent to \WindowsErrorReportingServicePort could reach SvcElevatedLaunch and launch WerFault.exe as SYSTEM with user-controlled arguments. The write-up included a proof of concept and noted operational constraints such as the WER service needing to be running and possible Microsoft Defender detection.
Microsoft addressed CVE-2026-20817, a local privilege escalation flaw in the Windows Error Reporting service, by effectively disabling the vulnerable SvcElevatedLaunch functionality so the patched code path returns E_FAIL. The issue allowed a low-privileged local user to trigger SYSTEM-context WerFault.exe execution via crafted ALPC messages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple **Windows Error Reporting Service** elevation-of-privilege vulnerabilities, including `CVE-2023-36721`, `CVE-2025-55692`, and `CVE-2025-55694`, in its Security Update Guide. The advisories identify the same Windows component as affected, indicating repeated security issues in the service that could allow an attacker to gain higher privileges on a targeted system. The vulnerabilities were published through Microsoft’s official advisory channels and tracked under separate CVE identifiers, showing that the Windows Error Reporting Service has remained a recurring source of privilege-escalation risk across multiple disclosure cycles. Organizations using Windows systems should prioritize Microsoft security updates for affected platforms and review exposure anywhere local privilege escalation could be chained with other access or execution paths.
Jul 12, 2026
A public proof-of-concept exploit has been released for **CVE-2026-42980**, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain **`NT AUTHORITY\SYSTEM`** access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds. Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a **CVSS 3.1 score of `7.8`**, and assessed exploitation as **"more likely."** While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.
Jul 23, 2026
Microsoft patched two actively exploited vulnerabilities in Microsoft Defender and related protection components, including **CVE-2026-41091**, a high-severity local privilege escalation flaw that can give an attacker **`NT AUTHORITY\SYSTEM`** privileges, and **CVE-2026-45498**, a medium-severity denial-of-service issue that can make Defender unavailable. The affected products include Microsoft Malware Protection Engine version **1.1.26030.3008 and earlier** and Microsoft Defender Antimalware Platform version **4.18.26030.3011 and earlier**, and both CVEs were added to CISA’s **Known Exploited Vulnerabilities** catalog due to active exploitation in the wild. Technical analysis of **CVE-2026-41091**, dubbed **RedSun**, says the bug lies in Windows Defender’s file remediation workflow when it processes malicious files marked as Cloud Files placeholders. A standard user can abuse Defender’s SYSTEM-level file operations, together with **NTFS junctions** and **oplocks**, to redirect a privileged write into **`C:\Windows\System32`**, plant a malicious binary such as **`TieringEngineService.exe`**, and then trigger execution through Storage Tiers Management COM activation to obtain a SYSTEM shell. Microsoft said the issues were fixed through automatic updates and urged organizations that disable auto-updates to manually update Defender and any products using the same engine and platform components.
Jul 24, 2026