CVE-2026-34348Patch(microsoft / windows_10_1809)

CRITICALCVSS 6.5 · MEDIUM

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch microsoft windows_10_1809 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.

microsoft CVEs Back to dashboard

8.3/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348

Weakness type (CWE)

CWE-693

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2

Threat summary

Active exploitation appears in 2 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
15 mentions across 10 observed days

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 10 signals
Technical details provided in 8 signals
General: 1 classified signal
Peaked 4d ago at 3 mentions (2026-08-10); latest day: 1
15 total mentions across 10 days

Affected systems

Vendors

microsoft

Products

windows_10_1809windows_10_21h2windows_10_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2019windows_server_2022windows_server_2025

Deep dive

Activity timeline15 mentions / 10d

Signal classification5 categories

Patch

1066.7%

Active Exploitation

213.3%

General

16.7%

PoC

16.7%

Disclosure

16.7%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	2	Patch2
2026-07-23	1	Active Exploitation1
2026-07-27	1	General1
2026-08-07	1	PoC1
2026-08-08	1	Patch1
2026-08-10	3	Active Exploitation1Patch2
2026-08-17	2	Patch2
2026-08-18	2	Patch2
2026-08-28	1	Disclosure1
2026-09-08	1	Patch1

Full discourse15 posts

📔 Michael Grafnetter@MGrafnetter68d
PoC
CVE-2026-34348 exploitation demo from my #BHUSA "Pass-the-Passkey Family of Attacks" talk: WebAuthn assertion from recent YubiKey authentication is extracted from Windows Event Log and replayed against Microsoft Entra ID using Passkey Injector. Whitepaper: https://specterops.io/passkeys https://t.co/uKSqEe9D2F
Post summary
The tweet announces a proof‑of‑concept demonstration for CVE-2026-34348 using Passkey Injector to replay a WebAuthn assertion, without indicating widespread exploitation or patch availability.
1618827846576123.7K
4.0K followersView on X
Merill Fernando@merill58d
Patch
@MGrafnetter The good news is both sides are patched: • Windows now truncates the logged message (CVE-2026-34348) • Entra checks authenticator signature counters and rejects replays
Post summary
The tweet announces that CVE‑2026‑34348 is mitigated by updates on both Windows and Entra, noting the specific changes applied. The post provides patch details without any exploitation or PoC information.
4107266.8K
21.1K followersView on X
SoyITPro@SoyITPro58d
Patch
Ojo con este CVE. Microsoft ya lanzó actualizaciones para esto en Julio. Comienzan a salir los "huecos" en las Passkey. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348
Post summary
Microsoft released July updates for CVE‑2026‑34348 affecting Passkey; the post notes the patch but contains no evidence of PoC, exploitation, or technical detail.
09043254.0K
13.8K followersView on X
mRr3b00t@UK_Daniel_Card67d
Patch
I'm just exploring these... on about 2026-07-15 the event logs stopped capturing the full payloads... from 94-96 chars to 8 chars.... That shows this machine patched ;) Automagically... https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348
Post summary
The message notes that after a Microsoft update, event logs no longer capture full payloads, indicating the CVE-2026-34348 has been patched.
2101954.3K
126.0K followersView on X
StevoTrades@StevoTrades57d
Patch
@UK_Daniel_Card I was wrong, hasnt been a year but a month. You should do an update https://windowsforum.com/security-alerts.84/cve-2026-34348-july-updates-fix-windows-event-log-data-leak.438313/
Post summary
The tweet points to a forum update that provides a patch for CVE‑2026‑34348, a Windows event‑log data‑leak vulnerability, with no mention of exploits or active attacks.
1001046
23 followersView on X
📔 Michael Grafnetter@MGrafnetter91d
Patch
@sapirxfed Yep, the same thought came into my mind. At least they fixed "my" CVE-2026-34348 yesterday. I get why they are so secretive about its connection to passkeys: "An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory."
Post summary
The author confirms that CVE‑2026‑34348 was patched yesterday and notes that the vulnerability would allow heap memory reads, but no proof of exploitation or PoC is shared.
1001066
3.1K followersView on X
Alex Seigler@alexseigler36d
Patch
@NathanMcNulty https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348 MSFT WebAuthn server doesn't invalidate the challenge immediately once it's used, so the server is vulnerable to a replay attack. The "fix" here was to hide the challenge from the event log, which is pretty half-assed if you ask me.
Post summary
The Microsoft WebAuthn server fails to invalidate used challenges, leaving it open to replay attacks; Microsoft’s mitigation of merely hiding the challenge from logs is inadequate.
10000136
410 followersView on X
Nik Kale@nik_kale47d
Disclosure
CVE-2026-34348 scored 6.5. It let an unprivileged authenticated user read YubiKey signatures in cleartext out of the Windows Event Logging Service. A 6.5 that defeats phishing-resistant MFA is not a medium. SpecterOps demonstrated privileged-user impersonation against policies requiring it. Unit 42 recovered private keys for Google Password Manager synced passkeys in Chrome on Windows. Dirk-jan Mollema showed malware in a signed-in session using Windows Hello for Business keys with no fresh PIN or biometric. Passkeys move the attack from the credential to the platform holding it. Roll them out anyway. Stop calling the rollout finished. https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html
Post summary
CVE‑2026‑34348 is a 6.5 severity vulnerability that lets authenticated users read YubiKey signatures from the Windows Event Logging Service, undermining phishing‑resistant MFA. The post references demonstrations of related attacks but provides no PoC, exploit code, or patch information.
00010109
399 followersView on X
SHIMSOFT@SHIMSOFT57d
Patch
@merill @MGrafnetter これは 2026/7/14 リリース（あるいはそれ以降）の更新を Windows Update 適用済みであれば　ログの記録メッセージは切り詰められていて、同様にコピー＆ペーストではサインインできなくなっているよ、という理解であっておりますか？ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34348
Post summary
The post discusses the mitigation for CVE‑2026‑34348, noting that after applying the 2026/7/14 update, log messages are truncated and copy/paste sign‑in is disabled, confirming patch status.
0001086
1.4K followersView on X
Windows Forum@windowsforum65d
Patch
🔐 Microsoft patched the Pass-the-Passkey replay flaw, but the alleged passkey-dialog spoof remains unverified and guidance-free. Secure? Maybe. Clear? Absolutely not. https://windowsforum.com/windows-news.4/cve-2026-34348-fixed-windows-passkey-spoofing-unverified.442267/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #WindowsSecurity #Passkeys #MicrosoftEntra #Cve202634348 https://t.co/igyyzcZI0t
Post summary
Microsoft has released a patch to fix CVE‑2026‑34348, a Pass‑the‑Passkey replay flaw, though the related passkey‑dialog spoof remains unverified and no guidance is yet available.
0000046
1.3K followersView on X
Aviatrix Threat Research Center@aviatrixtrc65d
Active Exploitation
TRC analysis shows attackers can now bypass phishing-resistant passkey MFA through multiple attack vectors. Researchers observed exploitation of Windows Event Logging Service (CVE-2026-34348) to access authentication data, enabling privilege escalation and lateral movement. Runtime segmentation helps contain post-compromise activity across network boundaries. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/new-passkey-attacks-can-recover-synced-private-keys-or-bypass-phishing-resistant-mfa
Post summary
Researchers report active exploitation of CVE-2026-34348 to bypass phishing‑resistant MFA, enabling privilege escalation and lateral movement; no PoC or patch information is provided.
0000061
1.9K followersView on X
TechNadu@TechNadu65d
Patch
Important context: some techniques require malware or an already compromised Windows session, and the findings are not one shared vulnerability. Microsoft patched CVE-2026-34348 and says separate Entra mitigations were also applied. https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html #CyberRiskMonitor
Post summary
Microsoft patched CVE-2026-34348 and applied additional Entra mitigations; no PoC, exploit code, or active exploitation is reported.
00000101
10.0K followersView on X
Windows Forum@windowsforum79d
General
🔐 Passkeys didn’t fail—Windows’ surrounding plumbing did. CVE-2026-34348 shows logs, cloud validation and fallback sign-ins can turn phishing-proof credentials into reusable loot. Patch day remains undefeated. https://windowsforum.com/windows-news.4/cve-2026-34348-windows-11-fixes-passkey-data-exposure.440578/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #Windows11 #Passkeys #Fido2 #MicrosoftEntraId https://t.co/kuSEWWqMQT
Post summary
The post references CVE-2026‑34348, indicating a passkey data exposure flaw that could turn phishing‑proof credentials into reusable loot, but offers no PoC, exploit details, or specific mitigation guidance.
0000049
1.3K followersView on X
Aviatrix Threat Research Center@aviatrixtrc83d
Active Exploitation
Attackers exploited Microsoft's passkey implementation (CVE-2026-34348) to extract authentication assertions from Windows Event Logs, enabling impersonation of privileged cloud users. The incident demonstrates how lateral movement across cloud services can escalate from authentication bypass vulnerabilities. #ZeroTrust #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/flaws-in-passkey-implementation-show-old-attacks-still-work-2026
Post summary
CVE-2026-34348 is actively exploited to read authentication assertions from Windows Event Logs, facilitating impersonation of privileged cloud users and lateral movement across cloud services.
0000065
1.9K followersView on X
Windows Forum@windowsforum91d
Patch
🪟 Windows Event Log was leaking data, because apparently even the logs needed a privacy update. CVE-2026-34348 is patched—install July’s cumulative updates before your “Important” problem gets louder. https://windowsforum.com/threads/cve-2026-34348-july-updates-fix-windows-event-log-data-leak.438313/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsServer #WindowsSecurityUpdates https://t.co/AbHyRVhohN
Post summary
The tweet alerts users that CVE‑2026‑34348, which caused data leakage via the Windows Event Log, has been fixed in July’s cumulative updates, urging them to apply the patch to avoid potential problems.
0000073
1.2K followersView on X

CPE platform detail19 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

19 of 19 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2019	-	-	x64
OS	microsoft	windows_server_2022	-	-	x64
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_10_1809 vulnerabilities

What researchers are saying

CVE-2026-34348

Merill Fernando[verified]@merillPatch

The tweet announces that CVE‑2026‑34348 is mitigated by updates on both Windows and Entra, noting the specific changes applied. The post provides patch details without any exploitation or PoC information.

SoyITPro[verified]@SoyITProPatch

Microsoft released July updates for CVE‑2026‑34348 affecting Passkey; the post notes the patch but contains no evidence of PoC, exploitation, or technical detail.

mRr3b00t[verified]@UK_Daniel_CardPatch

The message notes that after a Microsoft update, event logs no longer capture full payloads, indicating the CVE-2026-34348 has been patched.

Nik Kale[verified]@nik_kaleDisclosure

CVE‑2026‑34348 is a 6.5 severity vulnerability that lets authenticated users read YubiKey signatures from the Windows Event Logging Service, undermining phishing‑resistant MFA. The post references demonstrations of related attacks but provides no PoC, exploit code, or patch information.

SHIMSOFT[verified]@SHIMSOFTPatch

The post discusses the mitigation for CVE‑2026‑34348, noting that after applying the 2026/7/14 update, log messages are truncated and copy/paste sign‑in is disabled, confirming patch status.

Windows Forum[verified]@windowsforumPatch

Microsoft has released a patch to fix CVE‑2026‑34348, a Pass‑the‑Passkey replay flaw, though the related passkey‑dialog spoof remains unverified and no guidance is yet available.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

Researchers report active exploitation of CVE-2026-34348 to bypass phishing‑resistant MFA, enabling privilege escalation and lateral movement; no PoC or patch information is provided.

Windows Forum[verified]@windowsforumGeneral

The post references CVE-2026‑34348, indicating a passkey data exposure flaw that could turn phishing‑proof credentials into reusable loot, but offers no PoC, exploit details, or specific mitigation guidance.