Is CVE-2023-36874 (Microsoft Windows Error Reporting Service Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2023-36874 to its Known Exploited Vulnerabilities catalogue on 11 July 2023, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. Any organisation running the affected product should treat remediation as urgent.

What the KEV listing means for this CVE

CISA’s KEV listing is the key signal here. For CVE-2023-36874, it means the vulnerability was not just theoretical, because CISA judged there was reliable evidence of active exploitation. For defenders, that changes the question from “should we patch eventually?” to “what is exposed right now, and how quickly can we reduce the attack surface?”

The practical implication is that you should treat the Windows Error Reporting Service issue as a live exploitation concern, not a generic patch backlog item. If the affected service is present in your environment, the priority is to identify where it runs, which systems depend on it, and whether compensating controls can narrow exposure while remediation is being applied.

How privilege escalation changes the response

This is a privilege escalation flaw, so the operational concern is not only initial compromise but what an attacker can do after landing on a system. A successful exploit may let an intruder move from a lower-privilege foothold to a higher-value context, which increases the chance of credential access, persistence, and follow-on actions on the host.

That makes local investigation important even when the vulnerability is only one step in a wider intrusion chain. If you see unexpected service abuse, unusual child processes, new local administrators, tampered binaries, or signs of post-exploitation activity around the reporting service, treat those as compromise indicators rather than assuming the issue is “just a patchable bug.”

What to do when you cannot remediate immediately

If patching or mitigation has to wait, reduce exposure in ways that directly limit exploitation opportunity. That usually means restricting where the vulnerable service is available, tightening administrative access to the host, and removing any unnecessary local privilege that could make exploitation more useful to an attacker.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for authoritative remediation details, and confirm exposure against your own asset inventory rather than assuming all Windows hosts are affected. For vulnerability triage, the NIST National Vulnerability Database remains useful for record-level tracking, but KEV should drive urgency when exploitation is already confirmed.

If you need a practical response model for active exploitation, use NHIMG’s Zero-Day and Exploited Vulnerabilities Guide to structure emergency triage, compensation, and post-remediation hunting. If the issue is part of a broader patching problem, the Vulnerability Management Guide helps connect KEV-style urgency to prioritisation, verification, and remediation measurement.

Risk and Threat Considerations

Active exploitation means the threat is already operational, so delay creates real exposure rather than abstract risk. For a privilege escalation flaw, the main danger is that a modest initial foothold can be converted into broader host control, which can then be used for lateral movement, tampering, or credential theft.

Failure mechanism: An attacker who can reach the vulnerable service can exploit the flaw to gain elevated privileges, then use that higher trust level to persist, inspect local assets, or extend access beyond the original entry point.

Impact: The likely consequence is a materially larger blast radius than the original compromise, especially on systems that host sensitive data, management tooling, or administrative sessions.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events	Active exploitation requires monitoring for signs of compromise and malicious host activity.
	RS.AN-01 — Investigations are performed to analyze cybersecurity events	A KEV-listed privilege escalation warrants investigation for possible early compromise.
Recommendation — Monitor affected hosts for suspicious service abuse and privilege-escalation indicators. Investigate suspicious activity on systems where the vulnerability may have been exploited.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE demands urgent flaw remediation because it is actively exploited.
	AU-6 — Audit Record Review, Analysis, and Reporting	Privilege escalation incidents require review of logs for exploitation indicators.
Recommendation — Prioritize and apply remediation for the exploited Windows flaw without delay. Review audit records for signs of elevated access and post-exploitation activity.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV status makes continuous vulnerability prioritization and remediation central.
Recommendation — Prioritize and remediate the vulnerable service using KEV-driven urgency.

Practitioner Guidance

What to prioritise: Confirm which endpoints run the affected service, whether they are internet-facing or reachable from untrusted internal networks, and whether any of them already show signs of suspicious administrative activity. Systems with privileged users, remote management exposure, or adjacent sensitive credentials should move to the front of the queue.

What to verify: Do not stop at installation status. Verify whether the service is enabled, whether mitigation guidance has actually been applied, and whether post-exploitation evidence exists on the host. If you cannot prove a clean state, treat the machine as higher risk until the investigation is complete.

Practitioner takeaway: Once a CVE is in KEV, remediation becomes an incident-response problem as much as a patching problem, because the important question is whether exploitation has already started on your systems.