CVE-2022-21999

What it actually does

CVE-2022-21999 is a Windows Print Spooler elevation-of-privilege vulnerability affecting multiple Windows desktop and server releases. A local authenticated attacker with low privileges can abuse the Print Spooler service, which runs as SYSTEM, to perform privileged operations through improper handling of spooler-related paths/files. The practical result is local privilege escalation to SYSTEM, giving the attacker full confidentiality, integrity, and availability impact on the affected host. The CVSS vector indicates local attack requirements, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact across confidentiality, integrity, and availability.

Why it matters to the business

Successful exploitation turns any low-privileged Windows foothold into full local administrator/SYSTEM control on affected workstations and servers. Because the flaw is in the Windows Print Spooler, a service commonly enabled across enterprise fleets, it can materially increase ransomware impact: attackers who already gained initial access can disable defenses, dump credentials, move laterally, deploy persistence, and run destructive payloads with elevated privileges. This vulnerability is in CISA KEV, has documented exploitation in the wild, is associated with ransomware activity, and the CISA remediation deadline of 2022-04-15 has long passed, so any remaining exposure should be treated as overdue high-priority remediation.

How an attack unfolds

An attacker first needs local access to an affected Windows system, such as through malware execution, stolen user credentials, an interactive logon, or code execution as a standard user. The attacker then interacts with the Windows Print Spooler service, which runs with high privileges, and abuses the vulnerable spooler behavior to cause privileged file or path handling under attacker-controlled conditions. Because the service executes as SYSTEM, the attacker can turn limited local access into full machine control. After elevation, typical follow-on activity includes creating an administrator account, installing a service or scheduled task for persistence, disabling security controls, dumping credentials from memory or the registry, moving laterally, and deploying ransomware or other payloads. Exploitation is known in the wild and the vulnerability is listed in the Known Exploited Vulnerabilities catalog, so defenders should assume public exploit knowledge and mature attacker tradecraft exist.

How to fix it

Apply the Microsoft security update that addresses CVE-2022-21999 on all affected Windows client and server versions, including Windows 7/8.1/10/11 and Windows Server 2008/2012/2016/2019/2022 lines where applicable. Because no exact package fixed versions were provided, use Microsoft’s February 2022 security updates or any later cumulative update for the relevant Windows release. Prioritize internet-facing systems, remote access hosts, servers, domain controllers, virtualization hosts, file servers, and systems where Print Spooler is enabled but printing is not required. Where immediate patching is not possible, disable the Print Spooler service on systems that do not need printing using service configuration or Group Policy, and block inbound remote spooler/RPC access where operationally feasible. Harden printing configuration by restricting printer driver installation to administrators, limiting Point and Print to approved servers, and preventing silent elevation prompts. Compensating controls should be considered temporary; patching remains the primary remediation.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft February 2022 security update or a later cumulative update for its Windows release. Validate through centralized patch inventory, Windows Update history, Get-HotFix, DISM package inventory, or vulnerability scanner checks. Confirm that the Print Spooler service is disabled on systems where printing is not required and that Group Policy settings restricting printer driver installation and Point and Print are applied. Re-scan with an authenticated vulnerability scanner after patching. For high-value systems, validate that spoolsv.exe is not producing suspicious child processes and that no unexpected files, drivers, services, scheduled tasks, or local administrator accounts appeared around the remediation window.

Typical attack path

1. Gain initial local access to an affected Windows host as a standard user or through malware running with low privileges.
2. Confirm the Print Spooler service is present and running.
3. Invoke the vulnerable spooler functionality using crafted local print/spooler operations or exploit tooling.
4. Cause the privileged spooler service to process attacker-controlled path or file data and perform an operation as SYSTEM.
5. Obtain SYSTEM-level execution or write/modify privileged files needed for code execution.
6. Establish persistence, such as a new service, scheduled task, or privileged local account.
7. Disable defenses, dump credentials, and use the elevated context for lateral movement or ransomware deployment.

How to detect it

This is a local privilege-escalation vulnerability, so exploitation is usually visible through endpoint and Windows telemetry rather than perimeter network logs. Hunt for suspicious Print Spooler activity followed by privilege escalation, especially where a low-privileged user account triggers spooler operations and shortly afterward SYSTEM-level processes, service creation, credential access, or security-tool tampering occur. Review Microsoft-Windows-PrintService/Admin and Microsoft-Windows-PrintService/Operational logs for unexpected printer driver installation, printer configuration changes, spooler errors, or anomalous activity on systems that do not normally print. Review Windows Security logs for process creation and privilege events, including Event ID 4688 process starts, 4672 special privileges assigned, 4670 permission changes, 4697 service installation, and 7045 service creation in the System log. Review System logs for Print Spooler service restarts or crashes, including Service Control Manager events such as 7031, 7035, and 7036. In EDR, hunt for spoolsv.exe spawning command interpreters, scripting engines, LOLBins, or installers, and for writes into spool driver directories by unexpected users or processes. Also look for post-exploitation behavior: new local administrators, LSASS access, credential dumping tools, registry changes that weaken Point and Print protections, Defender exclusions, ransomware staging, and lateral movement shortly after spooler anomalies.

• C:\Windows\System32\spoolsv.exe
• ParentImage=C:\Windows\System32\spoolsv.exe
• C:\Windows\System32\spool\drivers\
• C:\Windows\System32\spool\PRINTERS\
• Microsoft-Windows-PrintService/Admin
• Microsoft-Windows-PrintService/Operational
• Event ID 316 printer driver installed
• Event ID 7031 Print Spooler service terminated unexpectedly
• Event ID 7036 Print Spooler service entered the running state
• Event ID 7045 service was installed
• spoolsv.exe -> cmd.exe
• spoolsv.exe -> powershell.exe
• spoolsv.exe -> rundll32.exe
• spoolsv.exe -> regsvr32.exe
• spoolsv.exe -> msiexec.exe
• spoolsv.exe -> wscript.exe
• spoolsv.exe -> cscript.exe
• HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint
• RestrictDriverInstallationToAdministrators
• NoWarningNoElevationOnInstall
• UpdatePromptSettings

What your security team should do

• Immediately identify all affected Windows endpoints and servers with the Print Spooler service enabled, prioritizing systems missing February 2022 or later cumulative security updates.
• Patch all affected systems; treat unpatched assets as high-risk because this vulnerability is in CISA KEV, has active exploitation, and is associated with ransomware activity.
• Disable the Print Spooler service on domain controllers, servers, and other systems that do not explicitly require printing.
• Use Group Policy or endpoint management to restrict printer driver installation to administrators and limit Point and Print behavior to approved print servers.
• Hunt for historical exploitation by correlating PrintService logs, spoolsv.exe process ancestry, service creation, privilege events, credential access, and ransomware precursor activity.
• Create EDR/SIEM detections for spoolsv.exe spawning command shells, scripting engines, installers, or LOLBins, and for unexpected writes under Windows spool driver directories.
• Verify local administrator group membership, newly created services, scheduled tasks, Defender exclusions, and credential-dumping artifacts on any host with suspicious spooler telemetry.
• Segment and monitor print servers closely, because compromise of print infrastructure can support broader privilege escalation and lateral movement.
• If compromise is suspected, contain the host, collect volatile evidence, rotate exposed credentials, and investigate lateral movement before re-enabling normal operations.