Privilege Escalation in Microsoft Windows Print Spooler (CVE‑2022‑21999) Threatens Enterprise Systems
What It Is – An unspecified flaw in the Windows Print Spooler service allows a low‑privileged user to execute code with SYSTEM rights.
Exploitability – Publicly disclosed; proof‑of‑concept code exists and the vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. CVSS v3.1 base score: 7.8 (High).
Affected Products – Microsoft Windows 10, Windows Server 2016‑2022 (all editions that include the Print Spooler service).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw bypasses least‑privilege boundaries, testing the effectiveness of privilege‑management controls.
- Patch‑management evidence – Rapid remediation is a key audit artifact; delayed patching signals gaps in continuous compliance monitoring.
- Defensible audit trail – Detecting abnormal spooler activity provides the logs needed to prove due diligence during assessments.
Recommended Actions
- Deploy Microsoft’s security update (KB 5012599 or later) across all Windows endpoints.
- Enforce “least‑privilege” policies for service accounts; restrict Print Spooler to only required machines.
- Enable and centralise Windows Event Log collection for PrintSpooler events (Event ID 7045, 7040).
- Validate that your patch‑management system records the remediation date as evidence for auditors.
Source: CISA KEV – CVE‑2022‑21999