CVE-2026-97798: high-severity vulnerability in Microsoft Windows 10 Version 21H2
Windows Error Reporting Service Elevation of Privilege Vulnerability
Published
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8
exploitation probability
—
observed exploitation
nono source reports it
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
Microsoft · Windows 10 Version 21H2Microsoft · Windows 10 Version 22H2Microsoft · Windows 11 version 23H2Microsoft · Windows 11 Version 24H2Microsoft · Windows 11 Version 25H2Microsoft · Windows 11 version 26H1Microsoft · Windows 11 Version 26H2Microsoft · Windows Server 2022Microsoft · Windows Server 2025Microsoft · Windows Server 2025 (Server Core installation)Related CVEs — Microsoft Windows 10 Version 21H2
In the same product, most dangerous first.
CVE-2021-34527HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 99.8%KEVCVE-2024-21412HIGHInternet Shortcut Files Security Feature Bypass VulnerabilityEPSS 99.4%KEVCVE-2022-30190HIGHMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityEPSS 99.2%KEVCVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 98.9%KEVCVE-2023-36025HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 88.1%KEVCVE-2025-33053HIGHInternet Shortcut Files Remote Code Execution VulnerabilityEPSS 87.0%KEV