What is the fix for CVE-2023-36874?

Apply the Microsoft Windows update for CVE-2023-36874 per vendor instructions; if updates are unavailable, discontinue use of the product (per CISA).

Live › vulnerability › CVE-2023-36874

Go to dashboard

high7.8Exploited in the wildInfrastructure

Windows Error Reporting Service Elevation of Privilege Vulnerability

Microsoft Windows Error Reporting Service has an unspecified flaw that lets a local user escalate privileges. CISA lists it as actively exploited in the wild.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Jul 11, 2023 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Jul 11, 2023.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Local low-privilege user gains elevated system privileges on the Windows host.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2023-36874

Go to dashboard

high7.8Exploited in the wildInfrastructure

Windows Error Reporting Service Elevation of Privilege Vulnerability

Microsoft Windows Error Reporting Service has an unspecified flaw that lets a local user escalate privileges. CISA lists it as actively exploited in the wild.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Jul 11, 2023 UTC
Last modified: Jun 17, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Jul 11, 2023.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Local low-privilege user gains elevated system privileges on the Windows host.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Microsoft Windows	vendor	–	–
microsoft windows 10 1507	vendor	< 10.0.10240.20048	10.0.10240.20048
microsoft windows 10 1607	vendor	< 10.0.14393.6085	10.0.14393.6085
microsoft windows 10 1809	vendor	< 10.0.17763.4645	10.0.17763.4645
microsoft windows 10 21h2	vendor	< 10.0.19041.3208	10.0.19041.3208
microsoft windows 10 22h2	vendor	< 10.0.19045.3208	10.0.19045.3208
microsoft windows 11 21h2	vendor	< 10.0.22000.2176	10.0.22000.2176
microsoft windows 11 22h2	vendor	< 10.0.22621.1992	10.0.22621.1992
microsoft windows server 2008	vendor	–	–
microsoft windows server 2008	vendor	= r2	–
microsoft windows server 2012	vendor	–	–
microsoft windows server 2012	vendor	= r2	–
microsoft windows server 2016	vendor	< 10.0.14393.6085	10.0.14393.6085
microsoft windows server 2019	vendor	< 10.0.17763.4645	10.0.17763.4645
microsoft windows server 2022	vendor	< 10.0.20348.1850	10.0.20348.1850

Windows Error Reporting Service Elevation of Privilege Vulnerability

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Windows Error Reporting Service Elevation of Privilege Vulnerability

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources