CVE-2022-38028

What it actually does

CVE-2022-38028 is a local privilege escalation vulnerability in the Windows Print Spooler service. An attacker who already has low-privileged local code execution on an affected Windows workstation or server can abuse the flaw to execute code with elevated privileges, potentially as NT AUTHORITY\SYSTEM. The vulnerability does not provide initial remote access by itself, but it is highly valuable after compromise because it can turn a standard user foothold into full local control of the host.

Why it matters to the business

Successful exploitation can allow an intruder who has gained a basic foothold on a Windows system to take full control of that machine, disable security tools, access sensitive data, dump credentials, move laterally, or deploy additional malware. Because this issue is in the Windows Print Spooler, affects many Windows desktop and server versions, is listed in CISA KEV, and has active in-the-wild exploitation, organizations should treat unpatched systems as high-priority remediation targets. The CISA KEV remediation due date was 2024-05-14, so any remaining exposure is overdue from a federal-risk-management perspective.

How an attack unfolds

An attacker first obtains the ability to run code as a low-privileged user on an affected Windows system, commonly through phishing, exploitation of another application, stolen credentials, or malware execution. The attacker then interacts with the Windows Print Spooler service or related print driver/spooler components to trigger the elevation-of-privilege condition. If exploitation succeeds, the attacker obtains a high-integrity or SYSTEM-level execution context. From there, they can create privileged processes, modify system configuration, tamper with endpoint defenses, access protected files, harvest credentials from memory or disk, and use the compromised host as a launch point for lateral movement. Public reporting and CISA KEV status indicate this vulnerability has been actively exploited in the wild, so exploitation should be considered plausible wherever affected Windows systems remain unpatched.

How to fix it

Apply the Microsoft security updates that address CVE-2022-38028 for all affected Windows versions, including Windows 8.1, Windows RT 8.1, Windows 10, Windows 11 22H2, Windows Server 2012, Windows Server 2016, Windows Server 2019, and Windows Server 2022. Because no product-specific fixed build numbers were provided in the input, use Microsoft’s October 2022 or later cumulative/security update guidance for each supported Windows release and verify that the relevant update is installed. Where the Print Spooler is not required, especially on servers, domain controllers, and sensitive administrative systems, disable the Print Spooler service or restrict it according to Microsoft hardening guidance. Limit local interactive access, remove unnecessary local administrator rights, enforce application control, and monitor for suspicious spooler-related activity. Systems that cannot be patched should be isolated, have Print Spooler disabled if operationally feasible, and be closely monitored until remediation is complete.

How to confirm the fix worked

Confirm exposure by inventorying affected Windows versions and checking whether the applicable Microsoft security update from October 2022 or a later cumulative update is installed. Validate that the Print Spooler service configuration matches business need: systems that do not require printing should have the Spooler service disabled and set to Disabled. On representative systems, verify patch status using Windows Update history, enterprise patch-management tooling, or PowerShell-based hotfix and build inventory. Confirm that standard users cannot trigger abnormal privileged process creation through Print Spooler paths or interfaces. For high-risk systems, review service state, installed printer drivers, spool directories, and recent security logs for suspicious activity before closing remediation tickets.

Typical attack path

1. Gain initial low-privileged access to an affected Windows workstation or server.
2. Confirm the Windows Print Spooler service is present and usable.
3. Run a local exploit that abuses the Print Spooler elevation-of-privilege flaw.
4. Obtain elevated execution, commonly SYSTEM-level privileges.
5. Create or launch privileged processes, services, scheduled tasks, or command shells.
6. Disable or evade security tooling and access sensitive local resources.
7. Harvest credentials and use the elevated host context for lateral movement or persistence.

How to detect it

To determine whether this vulnerability may have already been exploited, correlate endpoint telemetry, Windows Security logs, Sysmon logs if deployed, PrintService logs, service-control events, scheduled task events, and EDR process lineage. Focus on systems where low-privileged user activity is followed by SYSTEM-level process creation, local administrator group changes, new services, new scheduled tasks, unexpected printer driver installation, unusual writes under Windows spool directories, or security-control tampering. Review Microsoft-Windows-PrintService/Operational logs for anomalous printer driver or spooler activity and Windows Security logs for privilege use, account changes, and process creation if command-line auditing is enabled. Investigate spoolsv.exe spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, wscript.exe, cscript.exe, mshta.exe, certutil.exe, or other administrative tools. Examine C:\Windows\System32\spool\drivers\ and C:\Windows\System32\spool\PRINTERS\ for recently created or modified DLLs, executables, scripts, or abnormal spool files. Since this is a local privilege escalation, there may be no network-facing exploit signature; detection should emphasize host telemetry and post-exploitation behavior.

• spoolsv.exe
• C:\Windows\System32\spool\drivers\
• C:\Windows\System32\spool\PRINTERS\
• Microsoft-Windows-PrintService/Operational
• Microsoft-Windows-PrintService/Admin
• NT AUTHORITY\SYSTEM
• spoolsv.exe -> cmd.exe
• spoolsv.exe -> powershell.exe
• spoolsv.exe -> rundll32.exe
• spoolsv.exe -> regsvr32.exe
• spoolsv.exe -> wscript.exe
• spoolsv.exe -> cscript.exe
• spoolsv.exe -> mshta.exe
• spoolsv.exe -> certutil.exe
• A printer driver was added or updated
• The print spooler service was started
• The print spooler service was stopped
• C:\Windows\System32\spool\drivers\x64\
• C:\Windows\System32\spool\drivers\W32X86\

What your security team should do

• Prioritize patching all affected Windows servers, administrative workstations, and internet-adjacent or high-value systems because the vulnerability is CISA KEV-listed and exploitation has been observed in the wild.
• Disable the Print Spooler service on systems that do not require printing, especially domain controllers, servers, privileged access workstations, and sensitive infrastructure hosts.
• Use endpoint detection to alert on suspicious child processes, file writes, driver changes, or service manipulation associated with spoolsv.exe and Windows spool directories.
• Hunt for evidence of local privilege escalation around the time of any suspicious low-privileged user activity, including new administrator accounts, new services, scheduled tasks, credential dumping, and security-tool tampering.
• Ensure least privilege is enforced so ordinary users do not have unnecessary local administrator rights and cannot install untrusted printer drivers.
• Review patch-compliance reporting for unsupported or end-of-life Windows versions and either upgrade, isolate, or decommission them.
• Because the KEV due date has passed, escalate unresolved remediation as an overdue operational risk.