CVE-2023-36903: Windows 10 Privilege Escalation Vulnerability

CVE-2023-36903 Overview

CVE-2023-36903 is an elevation of privilege vulnerability in the Windows System Assessment Tool (WinSAT). Microsoft assigned the issue a CVSS 3.1 base score of 9.8, reflecting network-reachable exploitability with no privileges or user interaction required. The flaw is tracked under [CWE-59] (Improper Link Resolution Before File Access, or link following), indicating that an attacker can abuse symbolic-link or junction handling to manipulate files outside the intended scope. Successful exploitation lets an attacker gain elevated rights on the target system, undermining the boundary between standard users and SYSTEM-level operations.

Critical Impact

An attacker who successfully exploits CVE-2023-36903 can elevate privileges on supported Windows client and server platforms, leading to full host compromise.

Affected Products

• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (21H2 and 22H2, x64 and ARM64)
• Microsoft Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, and 2022

Discovery Timeline

• 2023-08-08 - CVE-2023-36903 published to the National Vulnerability Database
• 2023-08-08 - Microsoft publishes security update guidance for CVE-2023-36903
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36903

Vulnerability Analysis

The vulnerability resides in the Windows System Assessment Tool (WinSAT.exe), a built-in utility that benchmarks hardware performance and writes results to system-owned locations. Because WinSAT operations execute with elevated rights, mishandled file references inside its workflow expose privileged write or delete primitives to lower-privileged callers. The weakness is categorized as [CWE-59] (link following), meaning the component resolves a path through a symbolic link, junction, or hard link without validating the final target. An attacker who plants a crafted reparse point can redirect a trusted file operation to a protected location on disk. The result is unauthorized file creation, overwrite, or deletion under SYSTEM context, which translates into code execution at higher integrity.

Root Cause

The root cause is improper link resolution before file access. WinSAT opens or writes to paths that an unprivileged user can pre-stage with junctions or symbolic links pointing to sensitive targets. The component does not verify that the resolved object is the intended file, allowing a Time-of-Check to Time-of-Use (TOCTOU) style redirection.

Attack Vector

Local exploitation typically requires the attacker to stage a malicious filesystem object, then trigger WinSAT execution either directly or through a scheduled task that invokes the assessment tool. Once WinSAT follows the planted link, it performs a privileged action against an attacker-chosen target such as a service binary, DLL search path, or configuration file. Chaining this primitive with DLL hijacking or service replacement yields persistent SYSTEM execution. Microsoft has not confirmed in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability sits at 0.812% (74th percentile), reflecting moderate predicted exploit activity for this class of local privilege escalation flaw.

No verified public proof-of-concept code is available. See the Microsoft Security Update for CVE-2023-36903 for vendor technical details.

Detection Methods for CVE-2023-36903

Indicators of Compromise

• Creation of NTFS junctions or symbolic links inside directories accessed by WinSAT.exe, such as %WinDir%\Performance\WinSAT\DataStore.
• Unexpected modifications to SYSTEM-owned files or service binaries shortly after WinSAT.exe execution.
• New or modified files in protected paths (System32, Program Files) with timestamps correlating to WinSAT scheduled task runs.

Detection Strategies

• Monitor process creation events for WinSAT.exe spawned by non-administrative users or from unusual parent processes.
• Audit reparse point creation through Sysmon Event ID 11 and file system minifilter telemetry in directories writable by standard users.
• Correlate Scheduled Task triggers for Microsoft\Windows\Maintenance\WinSAT with subsequent privileged file writes.

Monitoring Recommendations

• Enable PowerShell and command-line logging to capture invocations of winsat.exe formal or related subcommands.
• Ingest Windows Security and Sysmon logs into a centralized analytics platform and alert on link-following patterns near privileged processes.
• Baseline normal WinSAT activity per host so deviations such as off-schedule execution surface quickly.

How to Mitigate CVE-2023-36903

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2023-36903 to all affected Windows client and server builds.
• Inventory unsupported hosts such as Windows Server 2008 R2 and accelerate decommissioning or extended security update enrollment.
• Restrict interactive logon rights on multi-tenant systems where local users could stage reparse points.

Patch Information

Microsoft addressed CVE-2023-36903 in the August 2023 Patch Tuesday cumulative updates for Windows 10, Windows 11, and Windows Server 2008 R2 through 2022. Administrators should validate that the latest cumulative update is installed using Get-HotFix or the Update Compliance reports and confirm no pending reboots remain.

Workarounds

• Disable or unschedule the Microsoft\Windows\Maintenance\WinSAT scheduled task on hosts where hardware assessment is not required.
• Remove write permissions for standard users on directories consumed by WinSAT.exe, including %WinDir%\Performance\WinSAT\DataStore.
• Enforce attack surface reduction policies that block untrusted processes from creating symbolic links via the SeCreateSymbolicLinkPrivilege user right assignment.

# Configuration example: disable the WinSAT scheduled task and audit symlink creation
schtasks /Change /TN "\Microsoft\Windows\Maintenance\WinSAT" /Disable
auditpol /set /subcategory:"File System" /success:enable /failure:enable
icacls "%WinDir%\Performance\WinSAT\DataStore" /inheritance:r /grant:r SYSTEM:F Administrators:F