Windows Error Reporting: Local privilege escalation due to weak authentication

Summary

Weak authentication in the Windows Error Reporting component allows an authorized local user with low privileges to elevate their privileges on the affected host. The CVSS v3.1 base score is 7.8 (High), with a full impact on confidentiality, integrity and availability of that host. An attacker needs an existing local foothold, for example a phished user account or malware running as a standard user, and the flaw is not directly reachable from the internet.

Affected

• Windows 10 Version 1607 (below 10.0.14393.9612)
• Windows 10 Version 1809 (below 10.0.17763.9376)
• Windows 10 Version 21H2 (below 10.0.19044.7807)
• Windows 10 Version 22H2 (below 10.0.19045.7807)
• Windows 11 Version 23H2 (below 10.0.22631.7652)
• Windows 11 Version 24H2 (below 10.0.26100.9711)
• Windows 11 Version 25H2 (below 10.0.26200.9711)
• Windows 11 Version 26H1 (below 10.0.28000.3231)
• Windows 11 Version 26H2 (below 10.0.26300.9711)
• Windows Server 2016, including Server Core (below 10.0.14393.9612)
• Windows Server 2019, including Server Core (below 10.0.17763.9376)
• Windows Server 2022 (below 10.0.20348.5761)

Fixed in

• Microsoft security update released October 13, 2026 (Patch Tuesday)
• Fixed builds: 10.0.14393.9612 (1607 and Server 2016), 10.0.17763.9376 (1809 and Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.20348.5761 (Server 2022), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2)
• KB number for Windows 10 1607 and Server 2016: Unknown. Check the Microsoft Security Update Guide.

Workaround

• Unknown. Microsoft has not published a specific workaround in the sources reviewed.
• Generic advice from a third-party aggregator: disable or restrict the Windows Error Reporting service if it is not required. This is not confirmed by Microsoft.

Exploitation

• CISA SSVC assessment (Vulnrichment): exploitation none, automatable no, technical impact total.
• EPSS score: 0.00432.
• No public proof-of-concept found.
• Not known to be in the CISA KEV catalog based on the sources reviewed; the KEV catalog was not checked directly.

Our recommendation

• Install the October 2026 Microsoft security update on all affected Windows clients and servers, prioritizing Terminal Servers, jump hosts, shared workstations and file servers.
• Verify the installed build number against the fixed builds listed above.
• For Windows 10 1607 and older builds, confirm that the device still receives updates (for example through Extended Security Updates or LTSB, depending on the edition) before assuming the fix will be delivered.
• Restrict local logon to trusted users and monitor for unexpected privilege changes on hosts with untrusted local access.
• Check for later exploitation reports and KEV status changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83840 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-83840 msrc.microsoft.com
• Vulners NVD record: CVE-2026-83840 vulners.com
• Vulners CVE List record: CVE-2026-83840 vulners.com
• OpenCVE: CVE-2026-83840 app.opencve.io
• Strix: CVE-2026-83840 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:53.