# CVE-2026-95947: Windows Error Reporting Elevation of Privilege Vulnerability

Status: published. Published: 2026-11-10. Updated: 2026-11-11.

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.
An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application.
The security update addresses the vulnerability by correcting the way that WER handles and executes files.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: microsoft) — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95947

## Affected products and versions

- Microsoft / Windows 10 Version 1607: ≥ 10.0.14393.0; < 10.0.14393.9688 (affected, custom). Source: CNA: microsoft; platforms: 32-bit Systems, x64-based Systems
- Microsoft / Windows 10 Version 1809: ≥ 10.0.17763.0; < 10.0.17763.9487 (affected, custom). Source: CNA: microsoft; platforms: 32-bit Systems, x64-based Systems
- Microsoft / Windows 10 Version 21H2: ≥ 10.0.19044.0; < 10.0.19044.7846 (affected, custom). Source: CNA: microsoft; platforms: 32-bit Systems, ARM64-based Systems, x64-based Systems
- Microsoft / Windows 10 Version 22H2: ≥ 10.0.19045.0; < 10.0.19045.7846 (affected, custom). Source: CNA: microsoft; platforms: 32-bit Systems, ARM64-based Systems, x64-based Systems
- Microsoft / Windows 11 version 23H2: ≥ 10.0.22631.0; < 10.0.22631.7711 (affected, custom). Source: CNA: microsoft; platforms: ARM64-based Systems
- Microsoft / Windows 11 Version 23H2: ≥ 10.0.22631.0; < 10.0.22631.7711 (affected, custom). Source: CNA: microsoft; platforms: x64-based Systems
- Microsoft / Windows 11 Version 24H2: ≥ 10.0.26100.0; < 10.0.26100.9974 (affected, custom). Source: CNA: microsoft; platforms: ARM64-based Systems, x64-based Systems
- Microsoft / Windows 11 Version 25H2: ≥ 10.0.26200.0; < 10.0.26200.9974 (affected, custom). Source: CNA: microsoft; platforms: ARM64-based Systems, x64-based Systems
- Microsoft / Windows 11 version 26H1: ≥ 10.0.28000.0; < 10.0.28000.3501 (affected, custom). Source: CNA: microsoft; platforms: ARM64-based Systems, x64-based Systems
- Microsoft / Windows 11 Version 26H2: ≥ 10.0.26300.0; < 10.0.26300.9974 (affected, custom). Source: CNA: microsoft; platforms: ARM64-based Systems, x64-based Systems
- Microsoft / Windows Server 2016: ≥ 10.0.14393.0; < 10.0.14393.9688 (affected, custom). Source: CNA: microsoft; platforms: x64-based Systems
- Microsoft / Windows Server 2016 (Server Core installation): ≥ 10.0.14393.0; < 10.0.14393.9688 (affected, custom). Source: CNA: microsoft; platforms: x64-based Systems
- Microsoft / Windows Server 2019: ≥ 10.0.17763.0; < 10.0.17763.9487 (affected, custom). Source: CNA: microsoft; platforms: x64-based Systems
- Microsoft / Windows Server 2019 (Server Core installation): ≥ 10.0.17763.0; < 10.0.17763.9487 (affected, custom). Source: CNA: microsoft; platforms: x64-based Systems
- Microsoft / Windows Server 2022: ≥ 10.0.20348.0; < 10.0.20348.5870 (affected, custom). Source: CNA: microsoft; platforms: x64-based Systems
- Microsoft / Windows Server 2025: ≥ 10.0.26100.0; < 10.0.26100.33822 (affected, custom). Source: CNA: microsoft; platforms: x64-based Systems
- Microsoft / Windows Server 2025 (Server Core installation): ≥ 10.0.26100.0; < 10.0.26100.33822 (affected, custom). Source: CNA: microsoft; platforms: x64-based Systems

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C; source: CNA: microsoft

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: NVD: secure@microsoft.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-306

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95947 (CNA: microsoft; vendor-advisory, patch)

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95947 (secure@microsoft.com)

## Provenance

- CNA: microsoft: https://www.cve.org/CVERecord?id=CVE-2026-95947; retrieved 2026-11-11; source updated 2026-11-11

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-95947; retrieved 2026-11-11; source updated 2026-11-10

Revision: aad30e68de8974d1435ba750e843533bc92e433c9cdf51f93f6741419044428a

Canonical: https://y2.dev/cve/CVE-2026-95947

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.