EUVD-2026-43788
GHSA-2333-38mw-8777
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L confirmed by 'authorized attacker' in description; AV:N consistent with Event Log remote interface; C:H and I:N/A:N match pure information disclosure with no modification or disruption impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
AnalysisAI
Windows Event Logging Service across a wide range of Windows 10, Windows 11, and Windows Server versions fails to enforce its intended protection mechanisms, permitting any authenticated low-privileged network user to read information that should be access-controlled. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only a valid low-privilege account and network connectivity, with no user interaction and no elevated rights - making it a practical post-compromise lateral-movement or reconnaissance tool. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis, but the ubiquitous deployment footprint across the Windows ecosystem elevates organizational exposure.
Technical ContextAI
The Windows Event Logging Service (eventlog) is a foundational OS component built into all modern Windows client and server editions, responsible for recording system, security, and application events that underpin audit trails, SIEM ingestion, and forensic investigations. CWE-693 (Protection Mechanism Failure) identifies the root cause as a bypass or non-enforcement of a security boundary - the service fails to restrict access to event data that should require elevated authorization. CPE data confirms the vulnerable codebase spans Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2019 including Server Core installations, with tags additionally referencing Windows Server 2022 and Windows Server 2025. This breadth indicates a shared code path across Microsoft's mainstream support lifecycle rather than a version-isolated regression. The network attack vector (AV:N) implies the flaw is reachable via standard event log remoting interfaces such as MSRPC-based EventLogRemote protocol rather than requiring local console access.
RemediationAI
Apply the vendor-released security update published by Microsoft via Windows Update, WSUS, or Microsoft Update Catalog; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348 for specific KB article numbers and servicing channel guidance applicable to each affected Windows version. The exact patched build version is not independently confirmed from the available input data beyond 'patch available per vendor advisory' - administrators should cross-reference the MSRC advisory for precise KB identifiers per OS version before deploying. As a compensating control prior to patching, restrict network access to the Windows Event Log remote interface (typically MSRPC over TCP, port 135 and dynamic high ports) using host-based Windows Firewall rules or perimeter network segmentation to limit which hosts can query event logs remotely - noting this will impact centralized log collection solutions such as Windows Event Forwarding (WEF), SIEM agents, and monitoring tools that rely on remote event log access. Additionally, apply the principle of least privilege by auditing and minimizing the number of accounts with any authenticated network access to affected hosts, reducing the pool of credentials that could satisfy the PR:L prerequisite.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today