Windows Error Reporting RCE flaw CVE-2026-83519 rated 9.8
Update (October 27, 2026)
Update: CISA added the two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, 2026, confirming active exploitation, according to The Hacker News. Federal agencies have until October 29, 2026 to apply fixes.
Both flaws carry a CVSS 4.0 score of 9.2 and allow unauthenticated remote code execution. The Hacker News reports that a researcher confirmed successful remote code execution against honeypot systems on October 24, on a single-worker mod_php setup; that result does not measure reliability on other configurations.
PHP fixes are in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Palo Alto Networks says PAN-OS on PA-Series, VM-Series and Panorama is affected and lists hotfix builds, some with ETAs of October 27 to 30. Treat internet-facing PHP and PAN-OS systems as priority patches.
At a glance
| Severity | CRITICAL |
|---|---|
| CVSS | CVE-2026-83519: 9.8 |
| EPSS (30-day exploit probability) | CVE-2026-83519: 1.1% |
| In CISA KEV (exploited) | No |
| Vendor | Windows |
| CVE IDs | CVE-2026-83519 |
Primary-source details
- CVE-2026-83519: CVSS 9.8 (Critical), per NVD; a fixed version has not been published.
Microsoft has listed CVE-2026-83519, a remote code execution flaw in Windows Error Reporting, in its Security Update Guide, and NVD rates it 9.8 out of 10 (critical). The bug is a heap-based buffer overflow that an unauthenticated attacker can reach over the network. It is not in CISA’s Known Exploited Vulnerabilities catalog, and no exploitation has been reported. The latest Microsoft Security Response Center entry is an informational update to an acknowledgement.
What happened
NVD published the record on 13 October 2026. It describes a heap-based buffer overflow (CWE-122) in Windows Error Reporting that lets an unauthorized attacker execute code over a network. A heap overflow means a program writes past the end of a memory buffer, which can let an attacker overwrite adjacent data and take control of execution.
Microsoft’s page changed only in its acknowledgements. The company has not said in the material listed here how the flaw was found, and the reporter is not named in that update.
Am I affected?
- Component: Windows Error Reporting, the Windows feature that collects and sends crash data.
- Affected Windows versions: not listed in the NVD record. Check Microsoft’s Security Update Guide entry for the exact builds.
- Fixed versions: not published in the NVD record; the entry lists no fixed version.
Technical details
- CVSS 3.1 score: 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - What the vector means: network attack, low complexity, no privileges and no user interaction needed, with high impact on confidentiality, integrity and availability.
- Weakness: CWE-122, heap-based buffer overflow.
- EPSS: 0.01084, roughly a 1.1% estimated probability of exploitation in the next 30 days.
- CISA KEV: not listed at the time of writing.
Why this matters
Analysis, not reported fact. A network-reachable, no-authentication, no-interaction code execution flaw is the profile that attackers like to turn into a worm or an initial-access tool once a working exploit appears. The low EPSS score and the absence from KEV suggest it is not a current emergency. Still, the score of 9.8 and the lack of required privileges mean it should be scheduled promptly rather than left for the next quarterly cycle.
It is not yet clear which systems expose the vulnerable code path to a network. Microsoft has not stated whether default configurations are reachable, so treat any Windows host reachable from untrusted networks as higher priority.
What to do
- Open the Microsoft entry for CVE-2026-83519 and note the update that applies to each Windows version you run.
- Prioritise servers and workstations that can be reached from the internet or from untrusted network segments, then the rest of the estate.
- If a patch is not available for a build, limit inbound network exposure of affected hosts. Microsoft has not published a workaround in the sources listed here.
- Re-check the entry and CISA’s KEV catalog regularly. If the flaw is added to KEV, patch within hours or days rather than weeks.
Detection and hunting ideas
No indicators of compromise have been published. Based on the nature of the bug, defenders can reasonably watch for unexpected crashes or restarts of Windows Error Reporting processes, unusual child processes spawned from them, and unexpected inbound connections to hosts that rarely receive them. These are general hunting ideas, not confirmed signs of exploitation.
Prioritisation for a typical environment
Analysis. Start with an inventory: list every Windows host and its build, because the affected versions are not yet stated in the NVD record. Hosts that sit on a network edge, in a DMZ or in a flat internal segment are the most exposed to an unauthenticated network attacker. Once Microsoft’s entry names the fixing update, fold it into the next patch window for those hosts first, and confirm deployment with your endpoint management tooling rather than assuming it applied.
Also tell your incident response team about the flaw now. If exploitation is reported later, they will already know which systems to check and which logs to pull.
What is still unknown
- Which Windows versions are affected.
- Which update fixes the flaw.
- Whether any exploit code exists or attacks have taken place. None has been reported.
