CVE-2023-36874

What it actually does

This is a local elevation-of-privilege vulnerability in the Windows Error Reporting Service. An attacker who already has low-privileged code execution on an affected Windows workstation or server can abuse the flaw to gain elevated privileges, potentially running code as a highly privileged local account such as SYSTEM. The vulnerability does not provide initial remote access by itself, but it can turn a foothold from phishing, stolen credentials, malware execution, or exploitation of another bug into full local control of the host.

Why it matters to the business

Successful exploitation can allow an intruder to take full control of affected Windows endpoints or servers, disable security tools, access sensitive data, dump credentials, install persistence, and move laterally. Because this vulnerability is listed in CISA KEV, has known in-the-wild exploitation, and had a federal remediation due date of 2023-08-01, unpatched systems should be treated as high-priority exposure even though the attack requires prior local access.

How an attack unfolds

An attacker first obtains a low-privileged foothold on an affected Windows system, commonly through malware, a compromised user account, remote access tooling, or a separate vulnerability. From that foothold, the attacker runs exploit code that abuses Windows Error Reporting Service behavior to perform privileged actions or execute attacker-controlled code with elevated rights. Once elevated, the attacker can create or modify privileged accounts, tamper with endpoint defenses, access protected files, harvest credentials from memory or the local system, deploy additional payloads, and use the compromised host as a launch point for lateral movement. Public reporting and KEV status indicate this vulnerability has been exploited in the wild, so detection should focus on signs of local privilege escalation followed by post-exploitation activity.

How to fix it

Install the Microsoft security updates that address CVE-2023-36874 for all affected Windows versions, including supported Windows 10, Windows 11, and Windows Server releases. Where exact fixed package versions are not provided, use the Microsoft Security Update Guide and deploy the July 2023 or later cumulative security update applicable to each OS build. Systems running end-of-life Windows versions should be upgraded to a supported release or covered by Extended Security Updates where available. If immediate patching is not possible, reduce risk by limiting interactive logon rights, removing unnecessary local administrator privileges, enforcing application control, monitoring Windows Error Reporting activity, and isolating high-risk unpatched systems until they can be updated.

How to confirm the fix worked

Confirm that each affected host has installed the Microsoft cumulative security update that includes the July 2023 fix or a later superseding update for its OS build. Validate through Windows Update history, enterprise patch management records, Microsoft Defender Vulnerability Management, WSUS/SCCM/Intune compliance data, or by comparing OS build and installed hotfix information against the Microsoft Security Update Guide. On representative systems, verify that update installation succeeded and that no rollback occurred. Exposure remains if affected Windows versions are missing the relevant July 2023-or-later security update, are unsupported without ESU coverage, or are excluded from normal patch deployment rings.

Typical attack path

1. Gain initial low-privileged access to an affected Windows workstation or server.
2. Execute local exploit code targeting the Windows Error Reporting Service vulnerability.
3. Obtain elevated privileges, potentially SYSTEM-level execution.
4. Run post-exploitation commands or tools with elevated rights.
5. Disable or tamper with security controls and logging where possible.
6. Dump credentials, access sensitive files, or create persistence.
7. Move laterally to additional systems using harvested credentials or administrative access.

How to detect it

There are no universally reliable public exploit-specific indicators for this vulnerability, so detection should focus on behavior around Windows Error Reporting followed by privilege escalation and post-exploitation. Review Windows Security logs for new privileged logons, special privileges assigned, process creation, new services, and local group membership changes. Useful sources include Windows Security events 4624, 4672, 4688, 4697, 4720, 4732, and 7045; Sysmon process, file, image-load, and registry events; Microsoft-Windows-WER-Diagnostics/Operational; Microsoft-Windows-Windows Error Reporting/Operational where available; EDR process telemetry; PowerShell logs; and file-system artifacts under Windows Error Reporting queues and archives. Hunt for WerFault.exe or wermgr.exe spawning command shells, scripting engines, LOLBins, or unknown executables; WER-related activity occurring immediately before SYSTEM-level execution by an unexpected binary; creation of services or scheduled tasks shortly after WER events; deletion or tampering with security logs; and credential-dumping behavior after local privilege escalation. Because normal Windows Error Reporting activity is common, detections should be correlated with suspicious child processes, unsigned binaries, anomalous user context changes, and subsequent administrative actions.

• WerFault.exe spawning cmd.exe
• WerFault.exe spawning powershell.exe
• WerFault.exe spawning pwsh.exe
• WerFault.exe spawning wscript.exe
• WerFault.exe spawning cscript.exe
• WerFault.exe spawning rundll32.exe
• WerFault.exe spawning regsvr32.exe
• WerFault.exe spawning mshta.exe
• wermgr.exe spawning cmd.exe
• wermgr.exe spawning powershell.exe
• wermgr.exe spawning rundll32.exe
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\Users\*\AppData\Local\Microsoft\Windows\WER\ReportQueue
• C:\Users\*\AppData\Local\Microsoft\Windows\WER\ReportArchive
• Microsoft-Windows-WER-Diagnostics/Operational
• Microsoft-Windows-Windows Error Reporting/Operational
• Service Control Manager Event ID 7045
• Security Event ID 4672
• Security Event ID 4688
• Security Event ID 4732
• WerSvc

What your security team should do

• Prioritize patch verification for internet-facing Windows servers, shared workstations, jump hosts, domain administration workstations, and systems used by privileged users.
• Treat unpatched systems as urgent because the vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Run enterprise-wide queries for affected Windows versions missing July 2023 or later cumulative security updates.
• Hunt for suspicious Windows Error Reporting activity followed by privilege escalation, credential access, security control tampering, new services, or new local administrators.
• Correlate detections involving WerFault.exe, wermgr.exe, or the WerSvc service with unusual child processes, command interpreters, script engines, or unsigned binaries.
• Review endpoint telemetry for low-privileged users suddenly obtaining privileged tokens, creating services, modifying security tools, or accessing credential stores.
• Harden local privilege boundaries by removing unnecessary local admin rights, enabling credential protection features, and enforcing application control where feasible.
• For systems that cannot be patched, isolate them, restrict interactive access, increase logging, and monitor closely until remediation is complete.