CVE-2022-26904

What it actually does

CVE-2022-26904 is a local elevation-of-privilege race condition in the Windows User Profile Service. A low-privileged local attacker can manipulate timing around profile-related filesystem operations so that a service running with elevated privileges performs an unintended action on attacker-controlled objects, potentially allowing code execution or security context escalation to NT AUTHORITY\SYSTEM. The flaw requires local access, low privileges, no user interaction, and has high complexity, but successful exploitation can compromise confidentiality, integrity, and availability of the affected Windows host.

Why it matters to the business

If exploited, an attacker who has already gained a foothold on a Windows workstation or server can turn limited access into full administrative control of that machine. This can enable credential theft, security tooling disablement, persistence, lateral movement, data access, and broader domain compromise. Because this vulnerability is listed in CISA KEV and has been observed exploited in the wild, unpatched systems should be treated as materially exposed; CISA’s remediation deadline was 2022-05-16.

How an attack unfolds

An attacker first obtains the ability to run code locally as a standard user, commonly through phishing, malware execution, stolen credentials, RDP/VPN access, or exploitation of another application. The attacker then runs an exploit that repeatedly triggers Windows User Profile Service behavior while racing profile-related filesystem operations. By using filesystem redirection techniques such as reparse points, junctions, hard links, or controlled profile paths, the attacker attempts to cause the elevated service to operate on a target chosen by the attacker rather than the intended profile object. If the race is won, the attacker can alter protected files, permissions, or execution paths in a way that results in elevated code execution. The attacker then launches a payload or command shell as SYSTEM and may proceed to dump credentials, create local administrator accounts, disable defenses, install persistence, or move laterally.

How to fix it

Install the Microsoft security updates released for CVE-2022-26904, including the April 2022 Windows cumulative/security updates or any later cumulative update for the affected Windows version. Prioritize Windows servers, administrator workstations, jump hosts, VDI/golden images, and endpoints with internet-facing or high-risk user activity. Systems running unsupported Windows versions should be upgraded to a supported release or covered by applicable Extended Security Updates where available. Where immediate patching is not possible, reduce risk by limiting local logon rights, removing unnecessary local administrator privileges, restricting write access to sensitive directories, enforcing endpoint detection controls, and monitoring for local privilege-escalation behavior. Mitigations should be considered temporary because the vulnerability is known exploited in the wild.

How to confirm the fix worked

Confirm each affected Windows host has the April 2022 or later cumulative/security update installed for its OS branch. Validate through Windows Update history, installed hotfix inventory, Microsoft Defender Vulnerability Management, WSUS/SCCM/Intune compliance reporting, or vulnerability scanners that explicitly check CVE-2022-26904. Verify that unsupported Windows versions are removed, upgraded, or under a supported ESU program. For gold images and offline templates, mount or boot the image and confirm the cumulative update level before redeployment. A host should be considered exposed if it is an affected Windows version and does not show the relevant April 2022-or-later security update level.

Typical attack path

1. Gain initial local code execution or an interactive/session-level foothold as a low-privileged Windows user.
2. Stage exploit files in a writable location such as the user profile directory or temporary directory.
3. Trigger User Profile Service operations repeatedly to create a race window.
4. Manipulate filesystem links or profile-related objects so elevated service operations are redirected to attacker-controlled targets.
5. Win the race condition and cause a privileged filesystem or permission change.
6. Execute a command, payload, service, scheduled task, or replacement binary with elevated privileges.
7. Use SYSTEM or administrator privileges to establish persistence, access credentials, disable controls, or move laterally.

How to detect it

To assess whether this was already exploited, correlate patch status with endpoint and Windows event telemetry around the time an unprivileged user account gained elevated privileges. Review Windows Security logs for process creation, privilege assignment, local group changes, service installation, scheduled task creation, and credential-access behavior. Useful events include 4688 for process creation, 4672 for special privileges assigned, 4624 for logon activity, 4732 for additions to local groups, 4697 or System 7045 for service installation, 4698 for scheduled task creation, and 1102 for audit log clearing. Review Microsoft-Windows-User Profile Service Operational logs for unusual or repeated profile load/unload failures, temporary profile creation, or profile path errors preceding privilege escalation. EDR telemetry should be searched for standard-user processes spawning SYSTEM-level shells, abnormal use of mklink/fsutil/cmd/PowerShell around user profile paths, creation of reparse points or junctions in writable directories, and immediate post-escalation actions such as credential dumping, security tool tampering, new local admins, or lateral movement tooling. There are no universally unique exploit artifacts for this vulnerability, so detection should focus on behavioral chains rather than a single file or command string.

• Microsoft-Windows-User Profile Service/Operational
• Security Event ID 4688
• Security Event ID 4672
• Security Event ID 4732
• Security Event ID 4697
• Security Event ID 4698
• System Event ID 7045
• Security Event ID 1102
• NT AUTHORITY\SYSTEM
• cmd.exe /c whoami /priv
• whoami /groups
• net localgroup administrators
• net user /add
• sc.exe create
• schtasks /create
• mklink /J
• mklink /D
• fsutil reparsepoint
• C:\Users\Public\
• C:\Windows\Temp\
• C:\Users\*\AppData\Local\Temp\

What your security team should do

• Treat this as high priority because it is in CISA KEV and exploitation has been observed in the wild.
• Patch all affected Windows endpoints and servers with April 2022 or later cumulative/security updates, prioritizing servers, privileged-access workstations, and systems used by administrators.
• Hunt for suspicious local privilege-escalation activity on unpatched or recently patched systems, especially standard-user processes that rapidly become SYSTEM or create persistence mechanisms.
• Review endpoint telemetry for unusual use of filesystem links, profile directory manipulation, service creation, scheduled task creation, or local administrator group changes.
• Restrict local logon and RDP access to only necessary users, and remove unnecessary local administrator rights.
• Ensure EDR, PowerShell logging, command-line process logging, and Windows Security auditing are enabled on high-value Windows systems.
• Rebuild or reimage hosts where exploitation is strongly suspected and credentials may have been exposed, then rotate affected credentials.