Critical Windows Error Reporting Vulnerability Allows SYSTEM Access via Privilege Escalation

Cybersecuritynews

Critical Windows Error Reporting Vulnerability Allows SYSTEM Access via Privilege Escalation

First seen 27 Mar 2026, 07:45 UTC • •72.6

Article Content

1 / 3

Browse articles

ThreatCluster •March 28, 2026 at 07:45 UTC

•CVE-2026-20817 allows local privilege escalation to SYSTEM access.
•Microsoft removed the vulnerable feature entirely due to its severity.
•The vulnerability was first publicly disclosed on January 13, 2026.

A local privilege escalation vulnerability in the Windows Error Reporting (WER) service, tracked as CVE-2026-20817, has been identified, allowing attackers to gain full SYSTEM access. This flaw enables local users with standard rights to escalate their privileges through improper permission handling. Due to the severity of the vulnerability, Microsoft has opted to completely remove the affected feature instead of issuing a traditional patch. The vulnerability was published on January 13, 2026, and the first proof of concept (PoC) was released on February 18, 2026. This poses a significant risk to systems running affected versions of Windows. Organizations are urged to assess their systems for exposure to this vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 194d ago How this analysis works

Timeline

2026-01-13

CVE-2026-20817 published

2026-02-18

First public PoC released

2026-03-27

Microsoft removes the vulnerable feature

More articles in this cluster (2)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Vulnerability (1)

CVE-2026-20817

Affected Platform (1)

Windows

Relationships

CVE-2026-20817 targets Windows
Zero-day Exploit targets Windows
T1068 - Exploitation for Privilege Escalation targets Windows

Following this threat?

Track CVE-2026-20817 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

Critical Citrix NetScaler Vulnerabilities Actively Exploited in Finland The National Cyber Security Centre Finland (NCSC-FI) issued an alert regarding critical vulnerabilities in Citrix NetScaler ADC and Gateway products, specifically CVE-2026-88771 and CVE-2026-88772, which are being actively exploited in Finland. These vulnerabilities allow attackers to execute remote code without…