CVE-2023-36874 is an error reporting service privilege escalation vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 11 July 2023, which means attackers have used it in real attacks. Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.
What this vulnerability means in Windows
CVE-2023-36874 is a privilege escalation flaw in the Microsoft Windows Error Reporting Service. The practical concern is not just that the service is buggy, but that a lower-privileged attacker may be able to turn that weakness into higher operating system rights on a host.
That matters because privilege escalation changes the security impact of an initial foothold. Once an attacker moves from a standard user context into elevated execution, they can usually do far more than the original compromise allowed, including tampering with local security settings, reaching additional data, or preparing the system for persistence.
Why this class of weakness is dangerous
Privilege escalation vulnerabilities are especially valuable to attackers because they convert limited access into control. In a Windows environment, that can be the difference between a contained incident and a machine-level compromise that can be used to stage follow-on activity.
The error reporting service is a trusted operating system component, so a flaw there is attractive when attackers already have some execution on the endpoint or server. Trust in a built-in service can reduce suspicion and make abuse harder to spot than a noisy exploit against a custom application.
For broader context on attacker tradecraft around privilege escalation and chained intrusion paths, see the MITRE ATT&CK Enterprise Matrix.
How organisations assess exposure and prioritise response
Exposure assessment starts with knowing where Microsoft Windows is deployed, which systems are reachable by untrusted users, and where local privilege boundaries matter most. Organisations should compare their asset inventory against the affected product in the vendor advisory, then cross-check whether the CVE appears in the NIST National Vulnerability Database and the CVE Program record for authoritative identification.
Because CISA placed this CVE in the Known Exploited Vulnerabilities catalogue, organisations should treat it as more than a theoretical bug. Active exploitation means prioritisation should be driven by real-world use, not only by internal severity scoring or abstract exploitability estimates.
A practical remediation workflow is to verify patch status, isolate systems that cannot be updated immediately, and confirm whether any privileged activity occurred before the fix was applied. A structured process such as the Vulnerability Management Guide is useful here because it ties asset scope, KEV awareness, remediation SLAs, and verification into one operational view.
Detection, remediation, and post-exploitation review
When exploitation is suspected, defenders should look for unusual service behaviour, unexpected privilege changes, new administrative activity, and evidence that the endpoint was used to pivot into other parts of the environment. If the vulnerability was chained with additional tooling, the surrounding activity may be more visible than the exploit itself.
Remediation should include patching, reviewing local administrator and service-account activity, and checking whether the host was used for lateral movement. If the attacker gained elevated access, incident responders should also review whether credentials, session material, or scheduled tasks were exposed or modified during the compromise.
Post-patch review matters because a fixed vulnerability does not erase earlier compromise. A host may remain at risk if an attacker established persistence, changed access rights, or dropped additional tooling before the vulnerability was closed.
Identity and privilege impact after exploitation
The main identity consequence of this CVE is privilege escalation, which means the attacker may have obtained authority beyond the original account context. That can affect local administrator rights, service control, and any material that was reachable from the elevated session.
If evidence shows the flaw was used in a live compromise, organisations should assume that any credentials or tokens accessible from that elevated context may need review or rotation. The more privileged the session, the more carefully responders should validate whether nearby administrative identities were touched during the incident.
For a broader lens on how privilege escalation fits into access governance and remediation planning, the Privileged Access Management Guide and the Vulnerability Management Guide are useful companions.
Risk and Threat Considerations
This CVE is materially risky because it was publicly exploited, affects a trusted Windows service, and can turn limited access into elevated control on a compromised host. That combination increases the chance of local persistence, security tool tampering, and follow-on movement inside the environment.
Failure mechanism: An attacker who already has a foothold abuses the service flaw to raise privileges, then uses the higher trust level to modify the system or stage additional actions.
Impact: The host can shift from a user-level compromise to an administrative or system-level incident, increasing the likelihood of data access, persistence, and wider intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | This CVE is a privilege escalation path used to gain higher rights on Windows. |
| Recommendation — Map observed exploitation to T1068 and hunt for privilege gain after the initial foothold. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE requires prompt remediation and verification of the Windows flaw. |
| AU-2 — Audit Events | Privilege escalation incidents require logging and review of suspicious service and admin activity. | |
| Recommendation — Track the Windows fix under SI-2 and verify vulnerable hosts are remediated. Ensure audit events capture elevated activity so post-exploitation review is possible. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This KEV-listed CVE needs priority discovery, patching, and verification. |
| CIS-8 — Audit Log Management | Detection and post-patch review depend on logs that show privilege changes and service abuse. | |
| Recommendation — Use CIS-7 to identify, prioritize, and remediate the vulnerable Windows systems. Use CIS-8 to centralize logs and review for escalation and persistence activity. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed privilege escalation flaws as operationally urgent, not just as patch hygiene. The key judgement is whether the vulnerable system can be updated quickly enough to prevent an exploit path that meaningfully increases attacker control.
What to watch for: Prioritise systems where the Windows Error Reporting Service is exposed on endpoints that already face untrusted code execution risk, because privilege escalation is most dangerous when an attacker has a starting foothold.
Practitioner takeaway: Validate patching, review for pre-fix compromise, and rotate or re-seal any privileged access that the attacker may have reached during exploitation.
Related resources from NHI Mgmt Group
- CVE-2024-26169 (Microsoft Windows Error Reporting Service Improper Privilege Management)
- CVE-2023-28229 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
- CVE-2023-36033 (Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation)
- CVE-2023-36036 (Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation)