CVE-2026-34348: Windows 10 1809 Information Disclosure Flaw

CVE-2026-34348 Overview

CVE-2026-34348 is an information disclosure vulnerability in the Windows Event Logging Service. The flaw stems from a protection mechanism failure [CWE-693] that allows an authenticated attacker to disclose sensitive information over a network. Microsoft rates the issue at CVSS 6.5 and assigns it MEDIUM severity. The vulnerability affects a broad range of supported Windows client and server operating systems, including Windows 10, Windows 11, and Windows Server 2019 through 2025.

Exploitation requires low-level privileges but no user interaction, making it attractive for attackers who have already established an initial foothold. The Event Logging Service handles security-relevant records, so successful exploitation may expose data useful for further lateral movement.

Critical Impact
An authorized network attacker can read sensitive information handled by the Windows Event Logging Service, potentially exposing data that supports credential harvesting, reconnaissance, and follow-on intrusion activity.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) — x86, x64, ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) — x64, ARM64
Microsoft Windows Server 2019, 2022, and 2025 (x64)

Discovery Timeline

2026-07-14 - CVE-2026-34348 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-34348

Vulnerability Analysis

The Windows Event Logging Service (EventLog) collects, stores, and exposes event records from applications, security auditing, and the operating system. According to Microsoft's advisory, a protection mechanism failure in this service allows an authorized attacker to disclose information over a network. The weakness maps to [CWE-693], which describes cases where a security control exists but fails to prevent the attack it was designed to stop.

The attack is network-reachable, requires low privileges, and does not require user interaction. Only confidentiality is affected; integrity and availability remain intact. The current EPSS probability is 0.715% at the 49.665 percentile, indicating a moderate near-term exploitation likelihood.

Root Cause

The root cause is an insufficient protection boundary in the Event Logging Service that permits an authenticated remote caller to retrieve event data that the service should have restricted. Microsoft's advisory does not disclose the exact code path or API, but the CWE-693 classification indicates the enforcement logic — rather than a memory safety error — is at fault.

Attack Vector

An attacker authenticates to the target environment using any valid low-privilege account, then interacts with the Event Logging Service over the network. Because Windows event logs frequently contain user names, process command lines, service identifiers, and audit metadata, disclosed content can reveal information useful for privilege escalation or lateral movement. See the Microsoft CVE-2026-34348 Advisory for authoritative technical details.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-34348

Indicators of Compromise

Unusual authenticated remote RPC connections to the Event Logging Service (EventLog) from workstations or accounts that do not typically query event logs.
Spikes in EventLog service activity originating from low-privilege user contexts.
Access attempts to Security, System, or custom event channels from accounts outside of established administrative groups.

Detection Strategies

Monitor Windows Security event IDs related to remote log access and RPC calls to eventlog endpoints, and baseline expected callers.
Correlate authentication events (4624, 4672) with subsequent Event Log queries to identify anomalous log-reading behavior by non-administrative accounts.
Alert on repeated failed or unusual EvtRpcOpenLogHandle and related MS-EVEN6 RPC operations from unexpected sources.

Monitoring Recommendations

Enable object access auditing on event log files under %SystemRoot%\System32\winevt\Logs\ where policy allows.
Forward Windows event logs to a centralized SIEM to detect cross-host log-access anomalies.
Track network flows to TCP endpoints associated with RPC and the Event Logging Service, especially from user subnets to servers.

How to Mitigate CVE-2026-34348

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-34348 Advisory to all affected Windows 10, Windows 11, and Windows Server systems.
Inventory endpoints and servers matching the affected builds (Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2019/2022/2025) and prioritize patching of internet-adjacent and domain-critical hosts.
Review and tighten membership of the Event Log Readers group and any accounts with remote log access rights.

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Response Center. Refer to the Microsoft CVE-2026-34348 Advisory for the specific KB articles and cumulative updates that address the vulnerability on each affected Windows build.

Workarounds

Restrict inbound RPC and SMB traffic to the Event Logging Service using host firewall rules, permitting access only from management subnets.
Enforce network segmentation so that only authorized administrative jump hosts can reach the Event Logging Service on servers.
Remove unnecessary accounts from Event Log Readers and other groups that grant remote log-reading privileges.
Require SMB signing and enforce strong authentication policies to reduce the population of accounts able to reach the service.

bash

# Example: Restrict remote Event Log access using Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Restrict Remote EventLog RPC" `
  -Direction Inbound `
  -Program "%SystemRoot%\System32\svchost.exe" `
  -Service EventLog `
  -Protocol TCP `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow