CVE-2024-26169

What it actually does

CVE-2024-26169 is a local elevation-of-privilege vulnerability in the Windows Error Reporting Service. A user who can already execute code on an affected Windows host can abuse improper privilege handling in the service to perform actions with SYSTEM-level privileges. Successful exploitation can give the attacker full local control of the machine, including the ability to read or modify protected files, create privileged processes, disable security controls, dump credentials, and prepare the host for lateral movement or ransomware deployment.

Why it matters to the business

This vulnerability turns an initial low-privilege foothold into full control of a Windows workstation or server. Because it is listed in CISA KEV, has confirmed in-the-wild exploitation, and is associated with ransomware activity, unpatched systems present a material risk of endpoint takeover, credential theft, lateral movement, data theft, service disruption, and ransomware deployment. The CISA remediation deadline was 2024-07-04, so any still-unpatched affected systems should be treated as overdue and high priority.

How an attack unfolds

An attacker first needs local access to an affected Windows system, typically through phishing, stolen credentials, malware execution, exploitation of another vulnerability, or remote access tooling. Once running as a standard user, the attacker executes exploit code that abuses the Windows Error Reporting Service's improper privilege management. The exploit manipulates WER-related privileged behavior so that attacker-controlled activity is performed in the security context of the service or another SYSTEM-level process. After privilege escalation, the attacker commonly launches a SYSTEM shell or payload, disables defenses, dumps credentials, stages additional tooling, moves laterally, and may deploy ransomware. Public reporting links exploitation of this vulnerability to ransomware operations, so post-exploitation activity should be investigated beyond the initially affected host.

How to fix it

Apply the Microsoft security updates released for CVE-2024-26169 to all affected Windows versions, including Windows 10, Windows 11, Windows Server 2008, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2 where applicable. Because no fixed build numbers were provided in the input, validate remediation through Microsoft Update, WSUS, Intune, Configuration Manager, or the Microsoft Security Update Guide for the exact operating system build. Prioritize internet-facing servers, domain-joined servers, remote access systems, administrator workstations, jump hosts, and systems used by privileged users. If immediate patching is not possible, reduce risk by removing local administrator rights, enforcing application control, restricting script and unsigned binary execution, monitoring WER-related process behavior, and isolating high-risk unpatched systems. Mitigations are not a substitute for installing the vendor update.

How to confirm the fix worked

Confirm that each affected Windows system has installed the March 2024 or later cumulative security update applicable to its OS version. Validate OS build and patch state using enterprise patch tooling, Windows Update history, PowerShell inventory, or vulnerability scanning authenticated to the host. Rescan with a vulnerability scanner that checks Microsoft bulletin applicability rather than relying only on banner or OS version detection. On a sample of remediated hosts, verify that the relevant cumulative update is present, the machine has rebooted if required, and the vulnerability is no longer reported. For systems that were exposed before patching, perform retrospective detection for suspicious WER service activity, SYSTEM-level process creation from unusual parent processes, and signs of ransomware staging or credential theft.

Typical attack path

1. Gain initial access to a Windows workstation or server using phishing, stolen credentials, malware, exposed remote access, or another exploit.
2. Establish local code execution as a low-privileged user.
3. Run an exploit targeting the Windows Error Reporting Service elevation-of-privilege flaw.
4. Abuse WER service privilege handling to obtain SYSTEM-level execution.
5. Launch privileged commands, malware, or administrative tooling under SYSTEM context.
6. Disable security tools, dump credentials, or access protected files.
7. Use stolen credentials and privileged access for lateral movement.
8. Stage data theft, persistence, or ransomware deployment.

How to detect it

To determine whether exploitation already occurred, review endpoint telemetry and Windows logs for suspicious privilege escalation behavior involving the Windows Error Reporting Service. Useful log sources include EDR process trees, Windows Security Event ID 4688 process creation, Sysmon Event ID 1 process creation, Sysmon Event ID 7 image loads, Sysmon Event ID 11 file creation, Sysmon Event ID 13 registry changes, Service Control Manager events such as 7036 and 7040, PowerShell logs, and Windows Error Reporting operational logs where enabled. Hunt for WER-related processes such as WerFault.exe, WerFaultSecure.exe, wermgr.exe, or svchost.exe hosting WerSvc spawning command shells, scripting engines, LOLBins, or unknown executables. Correlate any such activity with a transition from a low-privileged user context to NT AUTHORITY\SYSTEM. Examine WER report directories and user-writable temporary paths for unusual binaries, scripts, DLLs, or recently created artifacts. Because this flaw is associated with ransomware activity, also look for follow-on behaviors such as credential dumping, LSASS access, shadow copy deletion, mass file discovery, backup tampering, remote service creation, PsExec-like execution, RDP lateral movement, and encryption tooling. Absence of a single WER log entry does not rule out exploitation; rely on process, identity, file, and EDR telemetry correlation.

• WerSvc
• Windows Error Reporting Service
• WerFault.exe
• WerFaultSecure.exe
• wermgr.exe
• svchost.exe -k WerSvcGroup
• NT AUTHORITY\SYSTEM
• \ProgramData\Microsoft\Windows\WER\
• \Users\*\AppData\Local\Microsoft\Windows\WER\
• \Users\*\AppData\Local\Temp\
• Event ID 4688
• Event ID 7036
• Event ID 7040
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• vssadmin.exe delete shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled no
• wevtutil.exe cl
• rundll32.exe
• regsvr32.exe
• mshta.exe
• wscript.exe
• cscript.exe

What your security team should do

• Immediately identify all affected Windows endpoints and servers that have not received the Microsoft update for this vulnerability.
• Prioritize remediation for systems used by administrators, domain-joined servers, remote access hosts, file servers, virtualization hosts, and systems with security tooling or backup access.
• Treat unpatched systems as high risk because the vulnerability is in CISA KEV, has active exploitation, and is associated with ransomware activity.
• Hunt for prior exploitation using process creation logs, Sysmon telemetry, EDR alerts, Windows Error Reporting artifacts, service-control events, and privilege escalation anomalies.
• Investigate any suspicious SYSTEM-level shells or payloads spawned near WER-related activity, especially cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe, or unknown binaries.
• Review hosts with evidence of exploitation for credential dumping, defense evasion, lateral movement, persistence, data staging, and ransomware tooling.
• Enforce least privilege and remove unnecessary local administrator rights to reduce the value of local privilege escalation flaws.
• Use application control or EDR prevention policies to block unsigned or untrusted exploit binaries from user-writable directories.
• Monitor for abuse of WER components and unusual child processes of WerFault.exe, WerFaultSecure.exe, wermgr.exe, or svchost.exe hosting WerSvc.
• Ensure incident response playbooks account for ransomware-linked exploitation and include rapid host isolation when suspicious privilege escalation is detected.