CVE-2024-26169

Microsoft Windows Error Reporting Service contains an improper privilege management flaw (CWE-269) that allows an elevation of privilege, rated CVSS 3.1 7.8 with a local attack vector, low attack complexity, and no user interaction required. An attacker who can already execute code with low privileges on a vulnerable machine — e.g., after phishing, malware, or another exploit — can trigger the flaw to gain elevated rights, with high impact on confidentiality, integrity, and availability, a step CISA notes has known ransomware use. Any unpatched deployment of Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server 2008/2012/2016/2019 is affected. CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-06-13, and related reporting links a Windows zero-day exploited before patching to Black Basta ransomware operations. EPSS estimates a 4.0% probability of exploitation within 30 days (90th percentile), and no public proof-of-concept code is known.

What to do: Apply Microsoft's June 2024 security updates (the release that fixed this CVE) to all listed Windows 10, Windows 11, and Windows Server versions, per the KEV-required action to apply vendor updates or discontinue use. Because the flaw requires prior local code execution and CISA lists known ransomware use, treat unpatched Windows hosts as at risk and check them for post-exploitation signs such as unexpected SYSTEM-level process activity, new persistence, or ransomware staging.