CVE-2026-977987.8High
CVE-2026-97798: Windows Error Reporting Service Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 21H2
Vendor fix available · Affected: Microsoft Windows 10 Version 21H2 · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.06 (6 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public3 public GitHub repositories (unverified), listed by PoC-in-GitHub27 Oct
- Not established: not seen
0.5%probability of exploitation in the next 30 days
41st percentile
050100
Higher than 41% of scored CVEs
7.8HighCVSS
LowMediumHighCrit.
DescriptionNVD
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
What changed
- PoC-in-GitHub lists 3 public GitHub repositories (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 9 Nov.
- Researcher publishes Windows flaw exploit enabling SYSTEM accessSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.