CVE-2022-21919

What it actually does

CVE-2022-21919 is a local elevation-of-privilege vulnerability in the Windows User Profile Service. An attacker who already has low-privileged code execution on an affected Windows host can abuse the way the service handles user-profile related operations to gain higher privileges, potentially up to NT AUTHORITY\SYSTEM. Successful exploitation can allow full local control of the affected machine, including reading sensitive data, modifying system files or settings, disabling security tooling, creating privileged accounts, and installing persistent malware. The CVSS vector indicates local access is required, user interaction is not required, and exploitation has high attack complexity, but the vulnerability is confirmed exploited in the wild and is listed in CISA KEV.

Why it matters to the business

This flaw can turn an initial low-privileged compromise into complete control of a Windows workstation or server. In business terms, an attacker who first gets a foothold through phishing, stolen credentials, exposed remote access, or another vulnerability may use this issue to disable defenses, steal data, move laterally, deploy additional malware, or take over business-critical Windows systems. Because it is in CISA KEV with active in-the-wild exploitation and a remediation due date of 2022-05-16, unpatched systems should be treated as high-priority legacy exposure even though the EPSS score is modest.

How an attack unfolds

An attacker first needs the ability to run code locally as a standard or otherwise low-privileged user on an affected Windows system. They may obtain that foothold through malware, a compromised account, remote desktop access, exploitation of an unrelated service, or malicious software execution. The attacker then runs a purpose-built local exploit that interacts with Windows profile-management functionality and causes the User Profile Service to perform privileged actions in an unsafe way. If the exploit succeeds, the attacker obtains elevated privileges, commonly targeting SYSTEM-level execution. With those privileges, the attacker can create new administrator users, dump credentials, disable endpoint protection, install persistence, access protected files, or use the host as a staging point for lateral movement. Public reporting and KEV status indicate this vulnerability has been actively exploited, so defenders should assume it may be used as a post-compromise privilege-escalation step rather than as an initial access vector.

How to fix it

Apply the Microsoft security update that fixes CVE-2022-21919 for each affected Windows version. Affected platforms include Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 versions 1507, 1607, 1809, 1909, 20H2, 21H1, and 21H2, Windows 11 21H2, Windows Server 2008, 2012, 2016, 2019, 2022, and Windows Server 20H2. If systems are no longer supported, migrate them to a supported Windows release or isolate them until they can be retired. Where immediate patching is not possible, reduce exposure by preventing untrusted users from obtaining interactive or remote logon access, enforcing least privilege, restricting local admin rights, hardening RDP and remote management paths, blocking untrusted executable locations, and ensuring endpoint detection and response controls monitor local privilege-escalation behavior. Mitigations reduce risk but should not be considered a substitute for applying the vendor fix.

How to confirm the fix worked

Confirm that each affected Windows asset has the Microsoft security update released for this vulnerability installed, or a later cumulative update that supersedes it. Validate through centralized patch-management inventory, Windows Update history, installed hotfix data, endpoint management tooling, or vulnerability scanning. Spot-check representative systems using commands such as `winver`, `systeminfo`, PowerShell hotfix queries, or enterprise patch compliance reports to ensure the OS build level corresponds to the fixed January 2022-or-later security baseline for that Windows branch. Re-scan authenticated Windows assets after remediation to verify the vulnerability no longer appears. For systems that cannot be patched, document the exception, confirm compensating controls are active, and continuously monitor them for local privilege-escalation behavior.

Typical attack path

1. Gain low-privileged local code execution on an affected Windows workstation or server.
2. Confirm the host is running a vulnerable Windows build that has not received the January 2022 or later applicable security update.
3. Stage a local privilege-escalation tool or script on the host.
4. Trigger the vulnerable Windows User Profile Service behavior using crafted local profile, filesystem, registry, or service interactions.
5. Obtain elevated execution, potentially as NT AUTHORITY\SYSTEM.
6. Use elevated privileges to disable security controls, dump credentials, modify system configuration, create persistence, or move laterally.

How to detect it

This vulnerability is normally used after an attacker already has local access, so detection should focus on signs of privilege escalation and post-exploitation rather than network-only indicators. Review Windows Security logs, Sysmon or EDR process telemetry, Microsoft-Windows-User Profile Service operational logs, service-control events, PowerShell logs, and endpoint protection alerts. Look for suspicious process creation from user-writable paths followed by SYSTEM-level execution, new local administrator accounts, unexpected changes to local group membership, security tooling being stopped or disabled, credential-dumping activity, and abnormal interactions with user profile directories or registry hives. Useful Windows events include 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for logons, 7045 for new service installation, 4697 for service installation where enabled, 4732 for additions to local privileged groups, 1102 for audit log clearing, and 4688/Sysmon Event ID 1 for suspicious child processes. In Microsoft-Windows-User Profile Service/Operational logs, look for unusual profile load/unload failures, profile path manipulation, or profile service activity clustered around suspicious process execution. Because there are no widely reliable public exploit-specific file names or network signatures for this CVE, correlate behavioral indicators with patch status and timeline.

• Microsoft-Windows-User Profile Service/Operational
• ProfSvc
• User Profile Service
• NT AUTHORITY\\SYSTEM
• C:\\Users\\Public\\
• C:\\Windows\\Temp\\
• NTUSER.DAT
• reg load HKU\\
• reg unload HKU\\
• net localgroup administrators
• net user /add
• Event ID 4688
• Event ID 4672
• Event ID 7045
• Event ID 4732
• Event ID 1102
• Sysmon Event ID 1
• Sysmon Event ID 11
• Sysmon Event ID 13

What your security team should do

• Prioritize remediation on internet-facing Windows servers, remote-access hosts, domain-joined servers, jump hosts, administrator workstations, and systems used by privileged users.
• Treat unpatched affected Windows systems as urgent because the vulnerability is in CISA KEV and has documented active exploitation in the wild.
• Use authenticated vulnerability scanning or endpoint inventory to identify Windows builds missing the relevant January 2022 or later cumulative/security updates.
• Investigate any host where a low-privileged account quickly becomes local administrator or SYSTEM, especially following suspicious process creation from user-writable directories.
• Review endpoint telemetry for local privilege-escalation tool execution, suspicious service activity, credential dumping, new local administrators, and security-tool tampering.
• Restrict interactive logon, RDP, WinRM, and remote management access to only approved users and systems while remediation is underway.
• Remove unnecessary local administrator rights and enforce least privilege to limit the value of successful exploitation.
• For unsupported Windows versions, prioritize upgrade, isolation, or retirement because long-term patch assurance is limited.