CVE-2022-41125

What it actually does

CVE-2022-41125 is a local elevation-of-privilege vulnerability in the Windows CNG Key Isolation Service, which handles cryptographic key isolation operations. A low-privileged attacker who can execute code on an affected Windows host can trigger memory corruption in this privileged service and elevate execution to SYSTEM-level privileges. Successful exploitation can provide full local control of the affected machine, including access to sensitive data, credential material, security controls, and administrative operations.

Why it matters to the business

This vulnerability turns an initial low-privileged foothold into full control of Windows workstations or servers. In practice, it can help attackers move from phishing, stolen credentials, or malware execution to complete host takeover, credential theft, persistence, and lateral movement. It is listed in CISA KEV with active exploitation in the wild and had a federal remediation due date of 2022-12-09, so unpatched systems should be treated as high-priority exposure even though the flaw requires local access.

How an attack unfolds

An attacker first obtains the ability to run code as a standard user on an affected Windows system, commonly through phishing, malware, abuse of exposed remote access, or valid but low-privileged credentials. The attacker then executes exploit code that interacts with the Windows CNG Key Isolation Service and triggers the memory-corruption condition. Because the vulnerable service operates in a privileged Windows security context, successful exploitation allows the attacker-controlled code to run with elevated privileges, typically SYSTEM. With SYSTEM access, the attacker can disable defenses, dump credentials, access protected files, install persistence, create or modify privileged accounts, and use the compromised host as a platform for lateral movement. Public reporting indicates active exploitation in the wild, and CISA KEV inclusion means defenders should assume exploit code or operational tradecraft has been available to attackers for some time.

How to fix it

Install the applicable Microsoft Windows security updates released in November 2022 or any later cumulative update for all affected Windows versions, including Windows 8.1, Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, and Windows Server 2022. Because no safe product-level configuration fully removes the risk while preserving normal Windows cryptographic functionality, patching is the primary remediation. Prioritize internet-facing systems with local user access paths, shared workstations, remote desktop servers, VDI images, build agents, and servers where compromise would expose credentials or administrative tooling. If immediate patching is not possible, reduce exposure by limiting interactive logon rights, restricting RDP and remote management access, enforcing least privilege, preventing untrusted code execution with application control, and increasing monitoring for local privilege-escalation behavior.

How to confirm the fix worked

Verify that each affected Windows system has installed the November 2022 security update or a later cumulative update applicable to its OS build. Confirm through Windows Update, enterprise patch management, Microsoft Update Catalog baselines, or PowerShell inventory of installed hotfixes and OS build numbers. Validate that systems have been rebooted after patching where required. For gold images and offline templates, confirm the update is integrated before redeployment. Exposure can be checked by comparing the OS version and patch level against Microsoft’s November 2022 security update guidance for CVE-2022-41125. Where vulnerability scanners are used, ensure authenticated Windows scanning is enabled so missing cumulative updates are accurately detected.

Typical attack path

1. Gain initial execution on an affected Windows workstation or server as a low-privileged user.
2. Confirm the host is running a vulnerable Windows version or lacks the November 2022 or later security update that fixes this issue.
3. Run a local privilege-escalation exploit targeting the Windows CNG Key Isolation Service.
4. Trigger memory corruption in the privileged service to obtain SYSTEM-level execution.
5. Use elevated privileges to disable security tooling, access protected data, dump credentials, or modify system configuration.
6. Establish persistence or move laterally to other systems using stolen credentials or administrative access.

How to detect it

Look for evidence of both the privilege-escalation attempt and the activity that typically follows successful SYSTEM compromise. Useful sources include Windows Security logs, Sysmon, EDR process telemetry, service-control events, crash logs, Windows Error Reporting, PowerShell logs, and authentication logs. Focus on affected hosts that were missing the November 2022 or later cumulative update, especially where a standard user process is followed by SYSTEM-level process execution, new service creation, suspicious scheduled tasks, credential dumping, LSASS access, local administrator group changes, or security-tool tampering. Check for crashes or instability involving the CNG Key Isolation Service, keyiso.dll, or lsass.exe around the time of suspicious privilege changes; crashes are not required for exploitation, but they can be a useful pivot. Because there are no universal public file hashes or network indicators for this local vulnerability, detection should rely on behavioral correlation: low-privileged execution, abnormal interaction with privileged Windows services, sudden SYSTEM execution, and post-exploitation actions such as credential access or lateral movement.

• CVE-2022-41125
• KeyIso
• CNG Key Isolation
• keyiso.dll
• C:\Windows\System32\keyiso.dll
• lsass.exe
• C:\Windows\System32\lsass.exe
• Faulting module name: keyiso.dll
• Faulting application name: lsass.exe
• The CNG Key Isolation service terminated unexpectedly
• Service Name: KeyIso
• Event ID 7031
• Event ID 7034
• Event ID 4688
• Event ID 4672
• Event ID 7045
• Event ID 4697
• Event ID 4698
• Event ID 1102
• Event ID 4104
• A service was installed in the system
• Special privileges assigned to new logon
• The audit log was cleared
• Procdump.exe
• comsvcs.dll
• MiniDump
• sekurlsa
• lsass dump

What your security team should do

• Treat unpatched affected Windows systems as urgent because the vulnerability is in CISA KEV and has been exploited in the wild.
• Patch all affected Windows endpoints and servers with the November 2022 or later cumulative security update, prioritizing systems that permit interactive user logon or remote access.
• Hunt for signs of post-exploitation activity on systems that remained unpatched after public disclosure or after the CISA KEV due date of 2022-12-09.
• Review endpoint telemetry for low-privileged user processes that rapidly gain SYSTEM privileges or spawn administrative tools after interacting with cryptographic or LSASS-adjacent Windows services.
• Restrict local administrator rights, RDP access, and remote management access to reduce the chance that a local privilege-escalation flaw can be operationalized.
• Ensure EDR is configured to alert on credential dumping, LSASS access, suspicious service creation, unauthorized driver loading, and defense tampering following potential privilege escalation.
• Rebuild or deeply investigate systems where exploitation is suspected, because successful exploitation can grant full host control.