Executive brief
A security flaw exists in the Windows Event Logging Service, a core component that records system and application activities. An authorized user on the network could exploit this weakness to access sensitive information that they should not be able to see. This could lead to the exposure of internal system data or logs, potentially aiding further attacks against the organization.
Technical details
A protection mechanism failure (CWE-693) exists in the Windows Event Logging Service. The vulnerability allows an authenticated attacker with low privileges to disclose sensitive information over the network. The attack vector is network-based and does not require user interaction, though it does require the attacker to have valid credentials on the network. Successful exploitation results in a high impact on confidentiality. Microsoft has released security updates to address this issue across affected Windows 10, Windows 11, and Windows Server versions.
Affected products
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.9020
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.7548
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.7548
- Microsoft Windows 11 Version 23H2 10.0.22631.0 to 10.0.22631.7376
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 Version 26H1 10.0.28000.0 to 10.0.28000.2269
- Microsoft Windows Server 2019 10.0.17763.0 to 10.0.17763.9020
Timeline
- 2026-07-14: advisory: Initial publication by Microsoft and NVD
- 2026-07-14: patched: Security updates released by Microsoft