CVE-2022-22718

What it actually does

CVE-2022-22718 is a local elevation-of-privilege vulnerability in the Microsoft Windows Print Spooler service. A user with low-privileged local access can abuse improper handling within the spooler to execute code with elevated Windows privileges, potentially reaching SYSTEM-level control on affected Windows client and server versions. The vulnerability has low attack complexity, requires no user interaction, and affects confidentiality, integrity, and availability once exploited because the attacker can take over the local host.

Why it matters to the business

Successful exploitation can turn an initial low-privilege foothold into full control of a Windows workstation or server, enabling credential theft, security tool tampering, lateral movement, malware deployment, or persistence. Because Print Spooler is widely enabled across Windows environments and this vulnerability is listed in CISA KEV with known in-the-wild exploitation, unpatched systems represent a high-priority operational risk even though exploitation requires local access. The CISA remediation deadline was 2022-05-10, so any remaining exposure is materially overdue.

How an attack unfolds

An attacker first obtains low-privileged access to an affected Windows system through phishing, stolen credentials, remote access abuse, or another initial-access vulnerability. The attacker then runs a local exploit that interacts with the Windows Print Spooler service and abuses the vulnerability to cause privileged execution. If successful, the attacker obtains elevated privileges on the same host, commonly SYSTEM or equivalent administrative control. From there, they can dump credentials, disable defenses, install persistence, access sensitive files, deploy additional tooling, or move laterally to other systems. Active exploitation has been observed in the wild, so defenders should treat suspicious spooler-related privilege escalation activity as potentially malicious rather than theoretical.

How to fix it

Apply the Microsoft security updates released for CVE-2022-22718 and ensure affected Windows versions are updated with the February 2022 cumulative/security update or a later cumulative update. Because no exact per-product fixed versions were provided, validate patch status using Microsoft Update, WSUS, Microsoft Update Catalog, or enterprise patch-management reporting for the affected Windows releases. Where Print Spooler is not required, especially on servers and domain controllers, disable the Print Spooler service or restrict it from accepting client connections as a compensating control. Limit local interactive access, remove unnecessary local administrator rights, and monitor systems where Print Spooler must remain enabled. Legacy or unsupported Windows versions should be upgraded or isolated if they cannot receive security updates.

How to confirm the fix worked

Confirm that each affected host has installed the Microsoft security update that includes the February 2022 or later fix for CVE-2022-22718. Verify patch compliance through centralized patch tooling and by checking installed Windows cumulative updates on endpoints and servers. Confirm whether the Print Spooler service is required; if not, validate that the Spooler service is disabled and remains disabled after reboot. On systems where printing is required, verify the service is running only where business-justified and that endpoint detection, process creation logging, PowerShell logging, and PrintService operational logging are enabled. Validate exposure by inventorying Windows versions listed as affected and comparing them against current patch baselines.

Typical attack path

1. Gain low-privileged access to an affected Windows workstation or server.
2. Confirm the Print Spooler service is present and running.
3. Execute a local privilege-escalation exploit targeting the Print Spooler vulnerability.
4. Obtain elevated local privileges, potentially SYSTEM-level execution.
5. Use elevated access to run post-exploitation tools, harvest credentials, disable protections, or establish persistence.
6. Attempt lateral movement or broader compromise using newly obtained privileges or credentials.

How to detect it

To determine whether exploitation already occurred, review endpoint telemetry and Windows logs for suspicious Print Spooler activity followed by privilege escalation or post-exploitation behavior. Relevant sources include Windows Security logs, Microsoft-Windows-PrintService/Admin and Operational logs, System logs, Sysmon, EDR process/file telemetry, PowerShell logs, and service-control events. Look for spoolsv.exe spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe, certutil.exe, or bitsadmin.exe. Review file creation or modification under C:\Windows\System32\spool\, especially drivers and PRINTERS subdirectories, around the time of suspicious process or service activity. Correlate spooler events with Windows Security events for privilege use, new service installation, account creation, scheduled task creation, credential dumping indicators, or security tool tampering. Because there are no universally reliable public file hashes or single exploit artifact for this vulnerability, detection should focus on behavioral patterns and suspicious spooler-adjacent activity rather than a single static indicator.

• spoolsv.exe -> cmd.exe
• spoolsv.exe -> powershell.exe
• spoolsv.exe -> pwsh.exe
• spoolsv.exe -> rundll32.exe
• spoolsv.exe -> regsvr32.exe
• spoolsv.exe -> mshta.exe
• spoolsv.exe -> wscript.exe
• spoolsv.exe -> cscript.exe
• spoolsv.exe -> certutil.exe
• spoolsv.exe -> bitsadmin.exe
• C:\Windows\System32\spool\drivers\
• C:\Windows\System32\spool\PRINTERS\
• C:\Windows\System32\spool\drivers\x64\3\
• C:\Windows\System32\spool\drivers\W32X86\3\
• Microsoft-Windows-PrintService/Operational
• Microsoft-Windows-PrintService/Admin
• Event ID 7045
• Event ID 4688
• Event ID 4672
• Event ID 4697
• Event ID 4698
• Event ID 1102
• ParentImage: C:\Windows\System32\spoolsv.exe
• ImageLoaded: C:\Windows\System32\spool\drivers\
• TargetFilename: C:\Windows\System32\spool\drivers\
• TargetFilename: C:\Windows\System32\spool\PRINTERS\

What your security team should do

• Prioritize patch verification for all affected Windows client and server versions because the vulnerability is in CISA KEV and has active in-the-wild exploitation history.
• Disable the Print Spooler service on systems that do not need printing, particularly servers, identity infrastructure, and high-value administrative workstations.
• Hunt for suspicious child processes spawned by spoolsv.exe, unexpected file creation in spooler directories, and privilege escalation followed by credential access or defense evasion.
• Review systems that were unpatched after the 2022-05-10 CISA KEV deadline for evidence of historical compromise.
• Ensure EDR/SIEM detections cover local privilege escalation behavior, service creation, suspicious driver or DLL writes under spooler paths, and post-exploitation activity after spooler events.
• Reduce blast radius by limiting local logon rights, removing unnecessary local administrator privileges, and enforcing credential protection controls such as LSASS protection where feasible.