EXPOSURES › CVE-2023-36874
CVE-2023-36874
HIGH ⌖ ON CISA KEV · EXPLOITEDA Microsoft Windows Error Reporting Service vulnerability allows privilege escalation, and is currently being exploited in the wild.
This vulnerability in the Windows Error Reporting Service enables privilege escalation, potentially allowing attackers to gain higher-level access to systems. DIB organizations using Windows must immediately patch to prevent unauthorized access and maintain CMMC compliance. Verify patching status and consider compensating controls until remediation is confirmed.
Shame score — The active exploitation of a privilege escalation vulnerability in a core Windows service demonstrates a significant security oversight, especially given Microsoft's resources.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |