Loading vulnerability…
Local Privilege Escalation in Windows Event Logging Service
CVE-2026-33834 is an elevation-of-privilege vulnerability in the Windows Event Logging Service caused by improper access control. A locally authenticated attacker with only low privileges can exploit the flaw to elevate from a standard user context to NT AUTHORITY\SYSTEM. The vulnerable component is the Windows Event Logging Service, but the specific internal function or code path responsible for the access control failure has not been publicly documented. The issue affects multiple supported Windows client and server releases prior to Microsoft's patched builds and was addressed in Microsoft's May 2026 security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a local low-privilege attacker to obtain SYSTEM privileges. From that context, an attacker can execute arbitrary code with full local administrative control, access or modify protected system data, alter security settings and system configuration, install persistence, and potentially access credentials resident on the host. The CVSS v3.1 vector indicates high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
No vendor workaround or separate interim mitigation has been documented. Risk reduction is limited to standard hardening measures such as minimizing local interactive access, restricting untrusted code execution, enforcing least privilege, and prioritizing patch deployment on multi-user and high-value systems until the official fix is applied.
Patch, then assume compromise.
Apply the official Microsoft security updates released on 2026-05-12 for all affected Windows client and server versions. Where supported, deploy the corresponding cumulative update, security-only update, or Microsoft Security Hotpatch Update that contains the fix. Systems should be upgraded to Microsoft-provided patched builds for the affected release train.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.