CVE-2026-61347

This bug lets someone with only basic access to a Windows machine “peek” at hidden parts of memory. It’s like being able to read a few extra characters you’re not supposed to see when the computer is reporting events. The main risk is that confidential system details could be exposed, which can help an attacker later.

This affects Windows 10, Windows 11, and multiple Windows Server versions (2012, 2012 R2, 2016, 2019, 2022, 2025) that have the Windows Event Logging Service in place. It matters to you if your machines have users or accounts that could be compromised with low privileges (for example, a disgruntled employee account or malware that already got limited access). The risk is relevant because it’s reachable in default configuration and does not require user interaction, but it does require an attacker to already have valid low-level credentials on the device.

This is RED because the vulnerability is reachable in default configuration and can expose confidential system information to an attacker who already has low-level credentials. Even though it’s not currently listed as actively exploited in the provided sources, Microsoft-side urgency is reflected by patching activity, and patching closes a realistic “after-initial-access” step. Fix it urgently as part of your next patch window—or sooner if you have any indication of credential compromise.

1. Identify exposure

   • Confirm which exact Windows edition/build you run on each endpoint/server (Windows 10/11 or the specified Windows Server versions).
   • Determine which “branch” your system is on by checking the installed build number (your IT tool/Windows Update history can show this).

2. Confirm whether the fixed update is installed

   • For each affected system, compare your installed build to the fixed versions listed by Microsoft for CVE-2026-61347.

3. Apply the correct fixed version (per branch)

   • Windows 10:
     • fixed in 10.0.14393.9418
     • fixed in 10.0.17763.9121
     • fixed in 10.0.19044.7663
     • fixed in 10.0.19045.7663
   • Windows 11:
     • fixed in 10.0.22631.7517
     • fixed in 10.0.26100.9168
     • fixed in 10.0.26200.9168
     • fixed in 10.0.28000.2704
   • Windows Server 2012:
     • fixed in 6.2.9200.26280
   • Windows Server 2012 R2:
     • fixed in 6.3.9600.23338
   • Windows Server 2016:
     • fixed in 10.0.14393.9418
   • Windows Server 2019:
     • fixed in 10.0.17763.9121

4. Upgrade/patch process

   • Use the official Microsoft Update Guide for CVE-2026-61347 to download/apply the update for your build.
   • Reboot if your update requires it, and verify the update shows as installed.

5. Temporary workaround if patching is delayed

   • Limit low-privilege credential exposure: reduce the number of accounts that can log on with basic permissions, and rapidly remediate any signs of compromised credentials on the host.
   • Strengthen access controls so an attacker cannot easily obtain the “low-level credentials” prerequisite.

6. What to monitor after patching

   • Look for signs of abnormal local log activity from unusual accounts (especially attempts that look like local probing of system services).
   • Continue to monitor for any indicators of credential theft, since this bug is most relevant after initial access.

CVE-2026-61347 is an information disclosure vulnerability (CWE-126) in the Windows Event Logging Service caused by a buffer over-read (reading memory beyond intended limits). The findings indicate an attacker needs valid low-level credentials on the target machine, no user interaction is required, and the issue is reachable in default configuration. Public exploit code was not found in the provided sources, and there is no CISA KEV listing noted. Real-world exploitation is not confirmed in the provided reporting, but patch activity is highlighted (PULSE mentions actor Lazarus group as context for patch-related attention). The patch fixes are available as specific build numbers per OS version/branch via the MSRC Update Guide. EPSS is provided as a prediction in the findings and should not be treated as evidence of active exploitation.