7.8 CVE-2026-20817

Enriched by CISA
 

Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
https://nvd.nist.gov/vuln/detail/CVE-2026-20817

Categories

CWE-280 : Improper Handling of Insufficient Permissions or Privileges
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Always check to see if you have successfully accessed a resource or system functionality, and use proper error handling if it is unsuccessful. Do this even when you are operating in a highly privileged mode, because errors or environmental conditions might still cause a failure. For example, environments with highly granular permissions/privilege models, such as Windows or Linux capabilities, can cause unexpected failures. Special file system allows attackers to prevent ownership/permission change of certain entries by opening the entries before calling a setuid program. FTP server places a user in the root directory when the user's permissions prevent access to the their own home directory.

References


 

AFFECTED (from MITRE)

Vendor Product Versions
Microsoft Windows 10 Version 21H2
  • 10.0.19044.0 < 10.0.19044.6809 [affected]
Microsoft Windows 10 Version 22H2
  • 10.0.19045.0 < 10.0.19045.6809 [affected]
Microsoft Windows 11 version 22H3
  • 10.0.22631.0 < 10.0.22631.6491 [affected]
Microsoft Windows 11 Version 23H2
  • 10.0.22631.0 < 10.0.22631.6491 [affected]
Microsoft Windows 11 Version 24H2
  • 10.0.26100.0 < 10.0.26100.7623 [affected]
Microsoft Windows 11 Version 25H2
  • 10.0.26200.0 < 10.0.26200.7623 [affected]
Microsoft Windows Server 2022
  • 10.0.20348.0 < 10.0.20348.4648 [affected]
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
  • 10.0.25398.0 < 10.0.25398.2092 [affected]
Microsoft Windows Server 2025
  • 10.0.26100.0 < 10.0.26100.32230 [affected]
Microsoft Windows Server 2025 (Server Core installation)
  • 10.0.26100.0 < 10.0.26100.32230 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* < 10.0.19044.6809
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* < 10.0.19045.6809
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* < 10.0.22631.6491
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:* < 10.0.26100.7623
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:* < 10.0.26200.7623
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* < 10.0.20348.4648
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* < 10.0.25398.2092
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* < 10.0.26100.32230

REMEDIATION


EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
No entry