Windows Event Logging CVE-2026-34348

The CVSS PR:L metric confirms that a valid low-privileged authenticated account is required - unauthenticated or anonymous exploitation is not supported by the available data. Network connectivity to the target host's Event Logging Service interface is required (AV:N). No user interaction on the target system is needed (UI:N). Based on available CPE and description data, the flaw appears present in default installations of all affected Windows versions without requiring non-default feature enablement. Exploitation is strictly bounded to information disclosure (C:H, I:N, A:N) - integrity and availability are unaffected. The unchanged scope (S:U) means the attacker cannot pivot to other systems solely through this vulnerability. Exploitation is limited to hosts running one of the enumerated affected Windows versions; hosts running patched builds or outside the listed version channels are not subject to this flaw.

The CVSS 3.1 base score of 6.5 is well-grounded in the vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): network-reachable, low complexity, low-privilege authenticated, no user interaction, no scope change, confidentiality impact only. The High confidentiality impact is the most consequential signal - event logs routinely contain credentials in cleartext (failed/successful logon events, process command lines, script contents) and audit records that can materially accelerate an attacker's understanding of the environment. The PR:L requirement is the primary limiting factor; unauthenticated exploitation is not supported by the available data. EPSS data was not provided, preventing probabilistic exploitation rate assessment. This CVE is not listed in CISA KEV and no POC has been identified, which lowers immediate urgency. However, the AC:L rating means that once a low-privilege foothold is established, exploiting this vulnerability requires minimal tradecraft - making it a realistic secondary technique in multi-stage intrusions. The moderate CVSS score slightly undersells organizational risk when weighed against the ubiquitous deployment footprint and the sensitivity of Windows Security event logs.

An attacker who has obtained a low-privileged domain or local account - through credential phishing, password spraying, or lateral movement - connects over the network to a target Windows host and issues requests to the Windows Event Logging Service. Due to the protection mechanism failure, the service returns event log records beyond the caller's authorized scope, potentially exposing Security log entries containing logon activity, process execution details, or cleartext credentials passed via command-line arguments. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates that a working implementation would be straightforward for a moderately capable threat actor.