Privilege Escalation in Microsoft Windows User Profile Service (CVE‑2022‑21919)
What It Is
The Windows User Profile Service contains an unspecified flaw that can be leveraged to elevate a low‑privileged account to SYSTEM level. The vulnerability resides in the service that loads and manages user profile data during logon.
Exploitability
- Active exploitation: No public reports of active exploitation at the time of writing.
- Proof‑of‑Concept: A proof‑of‑concept has been released by security researchers, confirming that the flaw can be triggered locally.
- CVSS: Base score 8.8 (High) – Network‑local, Privilege Escalation, No user interaction.
Affected Products
All supported releases of Microsoft Windows that include the User Profile Service (e.g., Windows 10, Windows Server 2016/2019/2022). The vulnerability is not limited to a specific edition.
Why It Matters for Compliance & Audit Readiness
Privilege‑escalation pathways undermine the access‑control pillar of most security frameworks (NIST CSF PR.AC‑1, ISO 27001 A.9). Demonstrating that you have identified, patched, and documented such a risk is essential for:
- Continuous Control Monitoring – Evidence that privileged‑access controls are enforced and that deviations are promptly remediated.
- Defensible Audit Trail – Patch‑management logs, vulnerability‑scan findings, and remediation tickets provide the artifacts auditors expect for “adequate risk mitigation.”
- Vendor‑Management Controls – Tracking Microsoft security advisories and aligning patch cycles with contractual security clauses.
Recommended Actions
- Map the control – Link the vulnerability to your organization’s “privileged‑account management” control in your risk register.
- Validate patch status – Confirm deployment of Microsoft’s security update (KB 5004945 or later) across all Windows endpoints.
- Capture evidence – Export patch‑management reports and vulnerability‑scan results; store them in a tamper‑evident repository.
- Conduct targeted testing – Run a local privilege‑escalation scan on a representative subset of systems to verify remediation.
- Update monitoring rules – Add alerts for anomalous creation of SYSTEM‑level processes originating from non‑admin accounts.
Source: CISA KEV – CVE‑2022‑21919