PT-2026-2667 · Microsoft · Windows

Denis Faiustov + 1 · Published 2026-01-13 · Updated 2026-04-17 · CVE-2026-20817

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Error Reporting versions prior to January 2026

Description Improper handling of permissions in the Windows Error Reporting (WER) service allows an authorized local attacker to elevate privileges to NT AUTHORITYSYSTEM. The issue exists in the ALPC (Advanced Local Procedure Call) interface, which is a high-speed messaging system for local inter-process communication. Specifically, the service publishes the ALPC port 'WindowsErrorReportingService' but fails to perform authorization checks on callers within the CWerService::SvcElevatedLaunch() function. A low-privileged user can connect to this port and send a crafted message containing a handle to shared memory with an arbitrary command line. The service then processes this request and launches WerFault.exe or WerMgr.exe using a SYSTEM token, executing the attacker-controlled command.

Recommendations Apply the Microsoft January 2026 updates to resolve this issue. As a temporary workaround, restrict access to the vulnerable ALPC port 'WindowsErrorReportingService' to minimize the risk of exploitation.

Exploit

Fix

LPE

Weakness Enumeration

CWE-280

Related Identifiers

BDU:2026-00482

CVE-2026-20817

Affected Products

Windows

References · 34

• 🔥 https://github.com/oxfemale/CVE-2026-20817 · Exploit
• https://osv.dev/vulnerability/CVE-2026-20817 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-20817 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20817 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20817 · Security Note
• https://bdu.fstec.ru/vul/2026-00482 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20817 · Vendor Advisory
• https://twitter.com/ThreatSynop/status/2021219413110788106 · Twitter Post
• https://twitter.com/ThreatSynop/status/2028490148539777514 · Twitter Post
• https://twitter.com/techpio_team/status/2037613155581329792 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2024537646249152806 · Twitter Post
• https://twitter.com/dailytechonx/status/2021607730536923174 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2037345166848369097 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2021202194230612299 · Twitter Post
• https://t.me/poxek/5940 · Telegram Post