EUVD-2026-43788
GHSA-2333-38mw-8777
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L confirmed by 'authorized attacker' in description; AV:N consistent with Event Log remote interface; C:H and I:N/A:N match pure information disclosure with no modification or disruption impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
AnalysisAI
Windows Event Logging Service across a wide range of Windows 10, Windows 11, and Windows Server versions fails to enforce its intended protection mechanisms, permitting any authenticated low-privileged network user to read information that should be access-controlled. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only a valid low-privilege account and network connectivity, with no user interaction and no elevated rights - making it a practical post-compromise lateral-movement or reconnaissance tool. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis, but the ubiquitous deployment footprint across the Windows ecosystem elevates organizational exposure.
Technical ContextAI
The Windows Event Logging Service (eventlog) is a foundational OS component built into all modern Windows client and server editions, responsible for recording system, security, and application events that underpin audit trails, SIEM ingestion, and forensic investigations. CWE-693 (Protection Mechanism Failure) identifies the root cause as a bypass or non-enforcement of a security boundary - the service fails to restrict access to event data that should require elevated authorization. CPE data confirms the vulnerable codebase spans Windows 10 versions 1809 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2019 including Server Core installations, with tags additionally referencing Windows Server 2022 and Windows Server 2025. This breadth indicates a shared code path across Microsoft's mainstream support lifecycle rather than a version-isolated regression. The network attack vector (AV:N) implies the flaw is reachable via standard event log remoting interfaces such as MSRPC-based EventLogRemote protocol rather than requiring local console access.
RemediationAI
Apply the vendor-released security update published by Microsoft via Windows Update, WSUS, or Microsoft Update Catalog; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348 for specific KB article numbers and servicing channel guidance applicable to each affected Windows version. The exact patched build version is not independently confirmed from the available input data beyond 'patch available per vendor advisory' - administrators should cross-reference the MSRC advisory for precise KB identifiers per OS version before deploying. As a compensating control prior to patching, restrict network access to the Windows Event Log remote interface (typically MSRPC over TCP, port 135 and dynamic high ports) using host-based Windows Firewall rules or perimeter network segmentation to limit which hosts can query event logs remotely - noting this will impact centralized log collection solutions such as Windows Event Forwarding (WEF), SIEM agents, and monitoring tools that rely on remote event log access. Additionally, apply the principle of least privilege by auditing and minimizing the number of accounts with any authenticated network access to affected hosts, reducing the pool of credentials that could satisfy the PR:L prerequisite.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today