{"metadata": {"vulnerability": "cve-2026-20817", "count": 89, "kinds": {"milestone": 9, "sighting": 50, "kev": 0, "other": 30}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0007", "record": "NCSC-2026-0007", "field": "document.tracking.generator.date"}, {"timestamp": "2025-12-03T05:54:20.373Z", "date_only": false, "value": "2025-12-03T05:54:20.373Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-20817", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-01-13T00:00:00Z", "date_only": true, "value": "2026-01-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0044", "record": "CERTFR-2026-AVI-0044", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-01-13T08:00:00Z", "date_only": false, "value": "2026-01-13T08:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-20817", "record": "MSRC_CVE-2026-20817", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-01-13T08:00:00Z", "date_only": false, "value": "2026-01-13T08:00:00.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-20817", "record": "MSRC_CVE-2026-20817", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-01-13T08:00:00Z", "date_only": false, "value": "2026-01-13T08:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-20817", "record": "MSRC_CVE-2026-20817", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-01-13T08:00:00Z", "date_only": false, "value": "2026-01-13T08:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-20817", "record": "MSRC_CVE-2026-20817", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-01-13T16:00:00Z", "date_only": false, "value": "2026-01-13T16:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "cve-2026-20817", "field": "containers.cna.datePublic"}, {"timestamp": "2026-01-13T17:56:14.091Z", "date_only": false, "value": "2026-01-13T17:56:14.091Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-20817", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-01-13T18:01:16Z", "date_only": false, "value": "2026-01-13T18:01:16.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.thezdi.com/blog/2026/1/13/the-january-2026-security-update-review", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "891b0ff5-1cd1-4aba-b4da-22832fe94479", "url": "https://www.thezdi.com/blog/2026/1/13/the-january-2026-security-update-review"}, {"timestamp": "2026-01-13T18:03:51.656Z", "date_only": false, "value": "2026-01-13T18:03:51.656Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-20817", "record": "MSRC_CVE-2026-20817", "field": "document.tracking.generator.date"}, {"timestamp": "2026-01-13T18:16:08Z", "date_only": false, "value": "2026-01-13T18:16:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P4QH-CJ7J-R785", "record": "GHSA-P4QH-CJ7J-R785", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-01-13T18:16:08.647Z", "date_only": false, "value": "2026-01-13T18:16:08.647", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20817", "record": "FKIE_CVE-2026-20817", "field": "published"}, {"timestamp": "2026-01-13T18:16:30Z", "date_only": false, "value": "2026-01-13T18:16:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0007", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "8543fff1-066a-4392-8a93-2c903ec9be4b", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0007"}, {"timestamp": "2026-01-13T18:31:08Z", "date_only": false, "value": "2026-01-13T18:31:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P4QH-CJ7J-R785", "record": "GHSA-P4QH-CJ7J-R785", "field": "published"}, {"timestamp": "2026-01-13T19:16:30.720Z", "date_only": false, "value": "2026-01-13T19:16:30.720079Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0007", "record": "NCSC-2026-0007", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-01-13T19:16:30.720Z", "date_only": false, "value": "2026-01-13T19:16:30.720079Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0007", "record": "NCSC-2026-0007", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-01-13T23:00:00Z", "date_only": false, "value": "2026-01-13T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-01-13T23:00:00Z", "date_only": false, "value": "2026-01-13T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-01-13T23:00:00Z", "date_only": false, "value": "2026-01-13T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-01-14T00:00:00Z", "date_only": false, "value": "2026-01-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0044", "record": "CERTFR-2026-AVI-0044", "field": "last_revision_date"}, {"timestamp": "2026-01-14T00:00:00Z", "date_only": false, "value": "2026-01-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0044", "record": "CERTFR-2026-AVI-0044", "field": "initial_release_date"}, {"timestamp": "2026-01-14T00:00:00Z", "date_only": false, "value": "2026-01-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0044", "record": "CERTFR-2026-AVI-0044", "field": "revisions.0.revision_date"}, {"timestamp": "2026-01-14T04:56:44.739Z", "date_only": false, "value": "2026-01-14T04:56:44.739915Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-20817", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-01-14T04:56:44.739Z", "date_only": false, "value": "2026-01-14T04:56:44.739915Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20817", "record": "FKIE_CVE-2026-20817", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-01-14T23:00:00Z", "date_only": false, "value": "2026-01-14T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-01-18T23:00:00Z", "date_only": false, "value": "2026-01-18T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-02-10T10:09:30Z", "date_only": false, "value": "2026-02-10T10:09:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/02/10/windows-error-reporting-flaw-allows.html", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "5457f889-27e7-4c60-bdf5-3fdf03ba4dbf", "url": "https://threatintel.cc/2026/02/10/windows-error-reporting-flaw-allows.html"}, {"timestamp": "2026-02-10T10:26:06.552Z", "date_only": false, "value": "2026-02-10T10:26:06.552229Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3meiqrhtdni2d", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "fc7dc113-ded0-4ef6-a5e5-f7d533dad18e", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3meiqrhtdni2d"}, {"timestamp": "2026-02-10T11:09:21.314Z", "date_only": false, "value": "2026-02-10T11:09:21.314327Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/116046021324775284", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "e0327907-3ec5-45c6-a100-fd4df92fbf76", "url": "https://infosec.exchange/users/edwardk/statuses/116046021324775284"}, {"timestamp": "2026-02-10T12:37:45.667Z", "date_only": false, "value": "2026-02-10T12:37:45.667550Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3meiy4ujtf322", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "c7bdec5c-7610-4031-968e-563a3a93246e", "url": "https://bsky.app/profile/undercode.bsky.social/post/3meiy4ujtf322"}, {"timestamp": "2026-02-10T14:08:56.126Z", "date_only": false, "value": "2026-02-10T14:08:56.126720Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mej57vopf22v", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "e957b57e-3a3c-40f3-ab1e-e76b9b7e9216", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mej57vopf22v"}, {"timestamp": "2026-02-11T16:22:32.799Z", "date_only": false, "value": "2026-02-11T16:22:32.799464Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3melv5qoewh2w", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "3fe9c86a-de94-4f5e-8eb4-a6528eca1c29", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3melv5qoewh2w"}, {"timestamp": "2026-02-11T16:22:33.721Z", "date_only": false, "value": "2026-02-11T16:22:33.721898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3melv5rfpne2t", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "582c3675-4363-4446-8273-34ebe19e4515", "url": "https://bsky.app/profile/potato.software/post/3melv5rfpne2t"}, {"timestamp": "2026-02-18T14:14:44.647Z", "date_only": false, "value": "2026-02-18T14:14:44.647650Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mf5bbnqepu2c", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "b1041848-f021-4932-934e-4d38fb1907c4", "url": "https://bsky.app/profile/oxfemale.bsky.social/post/3mf5bbnqepu2c"}, {"timestamp": "2026-02-19T08:47:34.744Z", "date_only": false, "value": "2026-02-19T08:47:34.744754Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mf77hkpvuh2d", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "60aea74d-dd67-4cda-b6f5-9cb99d718b20", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mf77hkpvuh2d"}, {"timestamp": "2026-02-19T17:31:23.522Z", "date_only": false, "value": "2026-02-19T17:31:23.522733Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mfa4q7z7wz2m", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "acfa0599-59ec-403a-986a-b1d36cb85c50", "url": "https://bsky.app/profile/undercode.bsky.social/post/3mfa4q7z7wz2m"}, {"timestamp": "2026-02-19T23:00:00Z", "date_only": false, "value": "2026-02-19T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-02-20T09:35:00Z", "date_only": false, "value": "2026-02-20T18:35+09:00", "kind": "other", "label": "Dc:date", "source": "jvndb \u00b7 JVNDB-2026-004359", "record": "JVNDB-2026-004359", "field": "dc:date"}, {"timestamp": "2026-02-20T09:35:00Z", "date_only": false, "value": "2026-02-20T18:35+09:00", "kind": "other", "label": "Dcterms:modified", "source": "jvndb \u00b7 JVNDB-2026-004359", "record": "JVNDB-2026-004359", "field": "dcterms:modified"}, {"timestamp": "2026-02-21T13:27:50.045Z", "date_only": false, "value": "2026-02-21T13:27:50.045204Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/co11ateral.bsky.social/post/3mfepziijds2s", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "5abfb87c-7f0a-49d8-95a9-bf937a2eb1ed", "url": "https://bsky.app/profile/co11ateral.bsky.social/post/3mfepziijds2s"}, {"timestamp": "2026-02-24T12:32:22Z", "date_only": false, "value": "2026-02-24T12:32:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/5940", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "82859628-753b-4f09-bd62-f376c3c11df3", "content": "\u041f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0441 \u043d\u0443\u043b\u044f \u0434\u043e SYSTEM \u0447\u0435\u0440\u0435\u0437 WER\n#LPE #WER #Windows #CVE\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f CVE-2026-20817 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 Windows Error Reporting (WER) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043e\u0442 \u043d\u0438\u0437\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0434\u043e NT AUTHORITY\\SYSTEM.\n\n\u267e\ufe0f\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0441\u0443\u0442\u044c\u267e\ufe0f\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 ALPC. \u0421\u043b\u0443\u0436\u0431\u0430 WER, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0430\u044f \u043e\u0442 SYSTEM, \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u0440\u0442 \\WindowsErrorReportingService \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0440\u0430\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u0412 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 CWerService::SvcElevatedLaunch \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b. \u041d\u0438\u0437\u043a\u043e\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c ALPC-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0441 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u043e\u043c \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443.\n\n\u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0441\u043b\u0443\u0436\u0431\u0430:\n\n\u25aa\ufe0f \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0430\u043c\u044f\u0442\u044c,\n\u25aa\ufe0f \u0447\u0438\u0442\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0431\u0435\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438,\n\u25aa\ufe0f \u043f\u0440\u0438 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0442\u043e\u043a\u0435\u043d \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 fallback,\n\u25aa\ufe0f \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 SYSTEM-\u0442\u043e\u043a\u0435\u043d \u0447\u0435\u0440\u0435\u0437 CreateRestrictedToken, \u0443\u0434\u0430\u043b\u044f\u044f \u0442\u043e\u043b\u044c\u043a\u043e SeTcbPrivilege, \u043d\u043e \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438: SeDebugPrivilege, SeImpersonatePrivilege \u0438 SeBackupPrivilege. \n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441 WerFault.exe \u0438\u043b\u0438 WerMgr.exe \u0441 SYSTEM-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439.\n\n\u267e\ufe0f\u0418\u043c\u043f\u0430\u043a\u0442\u267e\ufe0f\n\n\u041f\u043e\u043b\u043d\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u2014 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 SYSTEM (\u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f LPE).\n\n\u267e\ufe0f\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f\u267e\ufe0f\n\n\u25aa\ufe0f \u0421\u043e\u0437\u0434\u0430\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u0443\u044e \u043f\u0430\u043c\u044f\u0442\u044c (CreateFileMapping, MapViewOfFile) \u0438 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, cmd.exe /c whoami > C:\\poc_wer.txt).\n\n\u25aa\ufe0f \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043a ALPC-\u043f\u043e\u0440\u0442\u0443 \\WindowsErrorReportingService \u0447\u0435\u0440\u0435\u0437 NtAlpcConnectPort / NtAlpcSendWaitReceivePort.\n\n\u25aa\ufe0f \u041e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 ALPC-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435: \u0442\u0438\u043f 0, \u043c\u0435\u0442\u043e\u0434 0x0D (WER_ELEVATED_LAUNCH_METHOD), \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438, \u0434\u043b\u0438\u043d\u0430 \u0441\u0442\u0440\u043e\u043a\u0438, PID \u043a\u043b\u0438\u0435\u043d\u0442\u0430.\n\n\u25aa\ufe0f \u041f\u043e\u0441\u043b\u0435 WER \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0443: SvcElevatedLaunch \u2192 ElevatedProcessStart \u2192 CreateElevatedProcessAsUser.\n\n\u25aa\ufe0f Fallback-\u043b\u043e\u0433\u0438\u043a\u0430 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u0439 SYSTEM-\u0442\u043e\u043a\u0435\u043d \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 CreateProcessAsUserW \u0441 WerFault.exe \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439.\n\n\ud83d\udd17\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a \u0438 PoC\n\n\ud83c\udf1a @poxek | \ud83d\udcf2 MAX |\ud83c\udf1a \u0411\u043b\u043e\u0433 | \ud83d\udcfa YT | \ud83d\udcfa RT | \ud83d\udcfa VK", "url": "https://t.me/poxek/5940"}, {"timestamp": "2026-02-26T15:04:38.126Z", "date_only": false, "value": "2026-02-26T15:04:38.126Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-20817", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-03-01T17:00:00Z", "date_only": false, "value": "2026-03-01T17:00:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://www.cryptika.com/poc-exploit-released-for-windows-error-reporting-alpc-privilege-escalation/", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "3dd66e9f-b0e4-4df0-8564-07075e32417a", "url": "https://www.cryptika.com/poc-exploit-released-for-windows-error-reporting-alpc-privilege-escalation/"}, {"timestamp": "2026-03-02T14:10:56.489Z", "date_only": false, "value": "2026-03-02T14:10:56.489945Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mg3gnw6b4z2w", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "658ec036-9589-432b-b460-8876095be48d", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mg3gnw6b4z2w"}, {"timestamp": "2026-03-02T23:00:00Z", "date_only": false, "value": "2026-03-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-03-02T23:00:00Z", "date_only": false, "value": "2026-03-02T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-03-03T11:12:18.782Z", "date_only": false, "value": "2026-03-03T11:12:18.782+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-0083", "record": "WID-SEC-W-2026-0083", "field": "document.tracking.generator.date"}, {"timestamp": "2026-03-03T11:23:26.471Z", "date_only": false, "value": "2026-03-03T11:23:26.471638Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mg5nrda5so2z", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "f6a9dc82-64bb-423f-9ba7-d694989167f3", "url": "https://bsky.app/profile/undercode.bsky.social/post/3mg5nrda5so2z"}, {"timestamp": "2026-03-03T18:04:14.612Z", "date_only": false, "value": "2026-03-03T18:04:14.612579Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mg6e5xtgwc2m", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "27b623c5-fef3-4f6e-a1e6-bb6a6ee5b2bd", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mg6e5xtgwc2m"}, {"timestamp": "2026-03-22T18:38:55.014Z", "date_only": false, "value": "2026-03-22T18:38:55.014056Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mho6xfi7sw42", "record": "cve-2026-20817", "field": "creation_timestamp", "uuid": "3b64731a-4586-4420-af66-c82cc946b4e6", "url": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mho6xfi7sw42"}, {"timestamp": "2026-03-27T02:02:47.823Z", "date_only": false, "value": "2026-03-27T02:02:47.823260Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdcyber.bsky.social/post/3mhyzmvttea25", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "3cbd602b-ac66-4bff-bc2d-4415627b7497", "url": "https://bsky.app/profile/crowdcyber.bsky.social/post/3mhyzmvttea25"}, {"timestamp": "2026-03-27T08:01:41.767Z", "date_only": false, "value": "2026-03-27T08:01:41.767788Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mhznonupj62s", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "ba562874-7ea6-4fcd-9241-095157d73c70", "url": "https://bsky.app/profile/undercode.bsky.social/post/3mhznonupj62s"}, {"timestamp": "2026-03-27T09:05:44.511Z", "date_only": false, "value": "2026-03-27T09:05:44.511931Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mhzrb6ipwo2d", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "4093c5d5-53db-4fc0-babc-1a01296285f5", "url": "https://bsky.app/profile/undercode.bsky.social/post/3mhzrb6ipwo2d"}, {"timestamp": "2026-03-27T09:16:29.840Z", "date_only": false, "value": "2026-03-27T09:16:29.840762Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhzrugjbly2y", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "29182056-3b1f-4e1e-8357-c74b028a5cd9", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mhzrugjbly2y"}, {"timestamp": "2026-03-27T12:30:21.977Z", "date_only": false, "value": "2026-03-27T12:30:21.977885Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/verbrecher/statuses/116301143769680087", "record": "cve-2026-20817", "field": "creation_timestamp", "uuid": "c98ff285-774b-4058-8137-845af4714666", "url": "https://mastodon.social/users/verbrecher/statuses/116301143769680087"}, {"timestamp": "2026-03-28T15:28:04.434Z", "date_only": false, "value": "2026-03-28T15:28:04.434844Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mi4x3qpjcs2p", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "fbcc4414-e277-4464-bba1-f540e9c7a887", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mi4x3qpjcs2p"}, {"timestamp": "2026-03-31T00:06:10.351Z", "date_only": false, "value": "2026-03-31T00:06:10.351115Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3micuxxje7k2m", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "e26928da-5086-488d-aaf9-571e7858db37", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3micuxxje7k2m"}, {"timestamp": "2026-04-09T06:23:32.721Z", "date_only": false, "value": "2026-04-09T06:23:32.721738Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mj26b4dnx52u", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "074075d2-b37e-498a-afd0-6fdb59a5e255", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mj26b4dnx52u"}, {"timestamp": "2026-04-10T10:53:42Z", "date_only": false, "value": "2026-04-10T10:53:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0007", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "d8cfd1ea-72b2-495a-8544-3c01022a370a", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0007"}, {"timestamp": "2026-04-10T12:53:42.521Z", "date_only": false, "value": "2026-04-10T12:53:42.521564Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0007", "record": "NCSC-2026-0007", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-04-10T12:53:42.521Z", "date_only": false, "value": "2026-04-10T12:53:42.521564Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0007", "record": "NCSC-2026-0007", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-04-17T13:54:30.490Z", "date_only": false, "value": "2026-04-17T13:54:30.490645Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/0patch/statuses/116420383122049547", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "a85b012d-31fc-4ae7-a93d-1d36fff7a8c9", "url": "https://infosec.exchange/users/0patch/statuses/116420383122049547"}, {"timestamp": "2026-04-17T14:13:46.717Z", "date_only": false, "value": "2026-04-17T14:13:46.717230Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mjp4b3fpksa2", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "acf551c5-132d-48ef-85e4-cd0a0ec7b794", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mjp4b3fpksa2"}, {"timestamp": "2026-04-17T21:25:01.012Z", "date_only": false, "value": "2026-04-17T21:25:01.012770Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mjpuecytmvi2", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "01e7f910-5ee0-4719-9655-967a6f49e781", "url": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mjpuecytmvi2"}, {"timestamp": "2026-04-18T03:53:04.947Z", "date_only": false, "value": "2026-04-18T03:53:04.947677Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjqk2ct6hd24", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "e6465f5b-3742-4d3b-90f3-602e2d79b05c", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mjqk2ct6hd24"}, {"timestamp": "2026-05-26T18:12:13.775Z", "date_only": false, "value": "2026-05-26T18:12:13.775Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2026-20817", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-26T21:31:35Z", "date_only": false, "value": "2026-05-26T21:31:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P4QH-CJ7J-R785", "record": "GHSA-P4QH-CJ7J-R785", "field": "modified"}, {"timestamp": "2026-05-28T09:00:04Z", "date_only": false, "value": "2026-05-28T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/OS002dw6m1PPRnz6IRCgKzakOZaHgvXDyO1kIUDG8FnuVXM", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "ec406529-2b6d-4ff1-b974-def2785ef808"}, {"timestamp": "2026-07-13T22:00:21.137Z", "date_only": false, "value": "2026-07-13T22:00:21.137510Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/90171", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "8bd9cc9a-0a5b-4156-8653-12382bff028f", "url": "https://t.me/GithubRedTeam/90171"}, {"timestamp": "2026-07-14T00:00:37.098Z", "date_only": false, "value": "2026-07-14T00:00:37.098623Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/90171", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "9716d76f-7216-44de-8e19-d81f7499d9cb", "url": "https://t.me/GithubRedTeam/90171"}, {"timestamp": "2026-07-15T00:00:19.447Z", "date_only": false, "value": "2026-07-15T00:00:19.447290Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/90171", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "7337b822-f911-4e04-8f0a-84720325615b", "url": "https://t.me/GithubRedTeam/90171"}, {"timestamp": "2026-07-20T19:00:05.044Z", "date_only": false, "value": "2026-07-20T19:00:05.044404Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/RMRFgroup/292", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "9b5f9563-b05b-4bc4-bbca-09987f0a52b7", "url": "https://t.me/RMRFgroup/292"}, {"timestamp": "2026-07-20T19:00:07.851Z", "date_only": false, "value": "2026-07-20T19:00:07.851737Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/3156", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "a03e0dac-21b2-4609-93cc-8f9f3ab0c909", "url": "https://t.me/proxy_bar/3156"}, {"timestamp": "2026-07-21T00:00:22.357Z", "date_only": false, "value": "2026-07-21T00:00:22.357992Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/RMRFgroup/292", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "8eccf2a5-043c-4eb7-9923-aa15b4ecb93e", "url": "https://t.me/RMRFgroup/292"}, {"timestamp": "2026-07-21T00:00:24.877Z", "date_only": false, "value": "2026-07-21T00:00:24.877464Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/3156", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "3d8b169a-c6a5-4424-888e-ba136aa5bedf", "url": "https://t.me/proxy_bar/3156"}, {"timestamp": "2026-07-22T00:00:27.805Z", "date_only": false, "value": "2026-07-22T00:00:27.805002Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/3156", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "89adf6da-2dc2-47a1-a520-3a9ac2f9cabd", "url": "https://t.me/proxy_bar/3156"}, {"timestamp": "2026-07-26T02:00:06.148Z", "date_only": false, "value": "2026-07-26T02:00:06.148598Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/1108", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "8ebdda62-f4d5-4bde-abee-1af1e8f92a16", "url": "https://t.me/cyberwarehouse/1108"}, {"timestamp": "2026-07-27T00:00:34.573Z", "date_only": false, "value": "2026-07-27T00:00:34.573666Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/1108", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "d500d5ff-d090-4fe9-bcec-f7f8a105614a", "url": "https://t.me/cyberwarehouse/1108"}, {"timestamp": "2026-07-29T12:03:14.289Z", "date_only": false, "value": "2026-07-29T12:03:14.289019Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/sysadm_in_up/2529", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "c4ae2fe3-dac2-4841-b764-8ddac0960b17", "url": "https://t.me/sysadm_in_up/2529"}, {"timestamp": "2026-07-30T00:03:00.179Z", "date_only": false, "value": "2026-07-30T00:03:00.179096Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/sysadm_in_up/2529", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "b835dd85-1276-4d99-b4b5-0578666e055c", "url": "https://t.me/sysadm_in_up/2529"}, {"timestamp": "2026-07-30T20:46:31.875Z", "date_only": false, "value": "2026-07-30T20:46:31.875Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-20817", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-30T20:46:31.875Z", "date_only": false, "value": "2026-07-30T20:46:31.875Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "cve-2026-20817", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-30T21:16:58.193Z", "date_only": false, "value": "2026-07-30T21:16:58.193", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-20817", "record": "FKIE_CVE-2026-20817", "field": "lastModified"}, {"timestamp": "2026-08-03T23:00:13.220Z", "date_only": false, "value": "2026-08-03T23:00:13.220522Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/sysadm_in_up/2529", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "dbf528a5-eba9-4273-aa52-0d93c9069699", "url": "https://t.me/sysadm_in_up/2529"}, {"timestamp": "2026-08-04T00:00:10.045Z", "date_only": false, "value": "2026-08-04T00:00:10.045362Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/sysadm_in_up/2529", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "fdcba10c-40a2-410f-9b11-7f2795a4325e", "url": "https://t.me/sysadm_in_up/2529"}, {"timestamp": "2026-08-27T20:00:10.273Z", "date_only": false, "value": "2026-08-27T20:00:10.273874Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityExploit/17006", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "43f8ca19-532d-44b2-afd4-2c2b3c8daa00", "url": "https://t.me/CyberSecurityExploit/17006"}, {"timestamp": "2026-08-28T00:00:06.994Z", "date_only": false, "value": "2026-08-28T00:00:06.994612Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityExploit/17006", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "b6d52176-0c1e-490c-9604-4896c10fe0d9", "url": "https://t.me/CyberSecurityExploit/17006"}, {"timestamp": "2026-09-02T06:00:16.067Z", "date_only": false, "value": "2026-09-02T06:00:16.067242Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingTeamGrupoOfficial/43158", "record": "CVE-2026-20817", "field": "creation_timestamp", "uuid": "ab24ed8d-23cc-4dc0-94b3-2a2df953bca1", "url": "https://t.me/HackingTeamGrupoOfficial/43158"}]}