CVE-2022-22047

What it actually does

CVE-2022-22047 is a local elevation-of-privilege vulnerability in the Windows Client Server Run-time Subsystem (CSRSS). An attacker who already has low-privileged code execution on an affected Windows system can exploit the flaw to obtain SYSTEM-level privileges. Because CSRSS is a core Windows user-mode subsystem involved in process and session management, successful exploitation can give the attacker full control of the host, including the ability to read or modify sensitive data, disable security tooling, install persistence, and move laterally using harvested credentials.

Why it matters to the business

This vulnerability turns an initial foothold on a Windows workstation or server into full host compromise. In practical terms, phishing, malware, stolen credentials, or exploitation of another application can be followed by privilege escalation to take over the machine. It affects a broad range of Windows client and server versions, including Windows 7, 8.1, 10, 11, and Windows Server 2008 through 2022. The vulnerability is listed in CISA KEV with a remediation due date of 2022-08-02 and has been observed exploited in the wild, so unpatched systems represent a material risk even though the flaw requires local access first.

How an attack unfolds

An attacker first gains the ability to run code as a standard user on an affected Windows system, commonly through phishing, malware execution, exploitation of a separate remote vulnerability, abuse of exposed services, or stolen low-privilege credentials. The attacker then runs exploit code locally that abuses the CSRSS elevation-of-privilege flaw to manipulate Windows privilege boundaries. If successful, the attacker obtains SYSTEM privileges on the same host. With SYSTEM access, the attacker can dump credentials, tamper with endpoint defenses, create privileged users or scheduled tasks, deploy additional malware, access protected files, and use the compromised system as a staging point for lateral movement. This vulnerability is most dangerous when chained after an initial access technique because it removes the normal limits on a low-privileged account.

How to fix it

Apply the Microsoft security updates released in July 2022 or later for all affected Windows versions. Prioritize internet-facing servers, jump hosts, domain-joined workstations, administrator workstations, and systems where users commonly open email attachments or browse the web. Because no fixed package versions were provided in the input, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch-management tooling to confirm that each affected OS build has the applicable cumulative update, security-only update, or monthly rollup installed. Where immediate patching is not possible, reduce risk by limiting local logon rights, removing unnecessary local administrator access, enforcing application control, blocking untrusted executable content, hardening EDR tamper protection, and isolating or closely monitoring legacy Windows systems. Mitigations should be treated as temporary; patching is the durable fix.

How to confirm the fix worked

Confirm remediation by verifying that each affected system has installed the applicable July 2022 or later Windows security update for its exact OS version and build. Use centralized patch compliance reporting, Windows Update history, WSUS/SCCM compliance state, endpoint-management inventory, or PowerShell commands such as Get-HotFix and OS build checks to validate update installation. Compare OS build numbers and installed KBs against Microsoft Security Update Guide for CVE-2022-22047. Vulnerability scanners should no longer report the host as vulnerable after the correct update is installed and the system has rebooted if required. For high-risk systems, also validate that standard users cannot obtain elevated administrative or SYSTEM privileges through known local privilege-escalation test procedures in a controlled environment.

Typical attack path

1. Gain low-privileged interactive or code-execution access to an affected Windows workstation or server.
2. Confirm the host is running a vulnerable Windows version or missing the July 2022 or later applicable security update.
3. Execute a local privilege-escalation exploit targeting CSRSS.
4. Obtain SYSTEM-level privileges on the compromised host.
5. Disable or evade security controls, access sensitive local data, and harvest credentials or tokens.
6. Establish persistence using privileged mechanisms such as services, scheduled tasks, drivers, or local administrator changes.
7. Use harvested credentials or elevated access to move laterally or deploy follow-on payloads.

How to detect it

There are no broadly reliable public indicators that uniquely identify exploitation of this vulnerability, and successful exploitation may appear only as a local privilege escalation followed by attacker activity. Hunt in endpoint telemetry, Windows Security logs, Sysmon logs, EDR process trees, service-control logs, scheduled task logs, PowerShell logs, and authentication events. Focus on sequences where a low-privileged user process is followed shortly by SYSTEM-level execution, especially from user-writable directories such as Downloads, Temp, AppData, or ProgramData. Review process-creation events for unusual children of cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or unknown binaries that rapidly transition into privileged activity. Look for post-exploitation artifacts including new services, new scheduled tasks, suspicious driver loads, LSASS access attempts, credential dumping tools, security-tool tampering, unexpected local administrator membership changes, and lateral movement attempts. Useful log sources include Windows Security Event IDs 4688 for process creation, 4672 for special privileges assigned, 4624 for logon activity, 4697 and System 7045 for service creation, 4698 for scheduled task creation, 4732 for local group membership changes, Sysmon Event IDs 1, 7, 10, 11, 12/13/14, and 22 where enabled, and EDR telemetry showing token elevation or privilege changes. Correlate any suspicious privilege escalation activity with hosts missing the July 2022 or later relevant Windows security update.

What your security team should do

• Treat this as high priority because it is in CISA KEV, has active in-the-wild exploitation, and the KEV remediation deadline has long passed.
• Identify all affected Windows client and server versions, with special attention to unsupported or legacy systems such as Windows 7, Windows Server 2008, and Windows Server 2012.
• Patch all affected systems with the applicable July 2022 or later Microsoft security updates and verify reboot completion where required.
• Prioritize systems used by administrators, systems with broad network reach, servers hosting sensitive workloads, and workstations exposed to email or web-delivered malware.
• Hunt for evidence of local privilege escalation followed by SYSTEM-level process execution from unusual parent processes or user-writable paths.
• Review recent alerts for credential dumping, EDR tampering, suspicious service creation, scheduled task persistence, and unexpected local administrator changes on Windows hosts.
• Reduce blast radius by enforcing least privilege, removing unnecessary local admin rights, enabling credential protection features, and applying application control where feasible.
• For systems that cannot be patched, isolate them, restrict interactive logon, monitor them aggressively, and plan accelerated retirement or upgrade.