CVE-2026-58608

What it actually does

This vulnerability is a race condition in Windows Print Spooler components that can be triggered remotely by an authenticated attacker over the network. Because the Print Spooler service runs with high local privileges on Windows systems, successful exploitation can allow attacker-controlled code to execute with elevated privileges, potentially as the spooler service account context. The CVSS vector indicates low attack complexity, no user interaction, network reachability, and high confidentiality, integrity, and availability impact. Affected platforms include supported Windows 10, Windows 11, and Windows Server versions listed in the advisory.

Why it matters to the business

A successful attack could let a low-privileged authenticated user take control of vulnerable Windows workstations or servers that expose the Print Spooler service, potentially leading to data theft, malware deployment, lateral movement, service disruption, or full host compromise. The highest-risk systems are servers, domain infrastructure, shared print servers, and endpoints where the spooler is reachable from untrusted or broadly accessible network segments. Although it is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no public exploit maturity reported, the high severity and network-accessible nature make timely remediation important.

How an attack unfolds

An attacker first obtains valid low-privileged credentials in the target Windows environment or uses an already-compromised account. They identify Windows hosts where the Print Spooler service is running and reachable over network print/RPC interfaces. The attacker then sends specially timed or concurrent print-spooler-related requests that trigger improper synchronization in a shared spooler resource. If the race is won, the service enters an unsafe state that allows attacker-controlled code execution. Because the Print Spooler service commonly runs with elevated local privileges, the attacker can use the resulting execution to establish persistence, dump credentials, move laterally, disable security controls, or deploy additional payloads.

How to fix it

Apply the applicable Microsoft security update or cumulative update for all affected Windows 10, Windows 11, and Windows Server versions as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Intune, or the organization’s patch management platform. No exact fixed build numbers were provided in the input, so remediation should be validated against Microsoft’s official advisory and current OS build guidance. Where printing is not required, disable the Print Spooler service. On servers where printing is not a business function, keep the service disabled by default. Restrict inbound access to Print Spooler/RPC/SMB services using host firewalls and network segmentation, especially from workstation networks, VPN ranges, guest networks, and untrusted segments. Limit who can connect to print services and harden Point and Print / printer driver installation policies. Prioritize remediation on domain controllers, file servers, print servers, remote-access-adjacent systems, and broadly reachable endpoints.

How to confirm the fix worked

Confirm that each affected Windows host has installed the relevant Microsoft security update or cumulative update and is running an OS build that Microsoft identifies as fixed. Validate patch deployment through centralized endpoint management, vulnerability scanning, and local checks such as Windows Update history, installed hotfix inventory, and OS build reporting. Verify that the Print Spooler service is disabled on systems that do not require printing. Confirm network exposure is reduced by testing that TCP 445, TCP 135, and dynamic RPC access to print-related services are blocked from unauthorized network segments. Review Group Policy or endpoint configuration to ensure Point and Print and printer driver installation controls are hardened. Re-run authenticated vulnerability scans after patching or mitigation to confirm the exposure is closed.

Typical attack path

1. Obtain valid credentials for a low-privileged Windows user or service account.
2. Scan internal network ranges for hosts exposing Windows Print Spooler-related services over RPC/SMB.
3. Confirm the Print Spooler service is running on target workstations or servers.
4. Send concurrent or specially timed spooler requests designed to trigger the race condition.
5. Achieve code execution in the context of the vulnerable Print Spooler service.
6. Deploy a payload, open a reverse connection, create a local administrator, or run post-exploitation tooling.
7. Use the compromised host for credential access, lateral movement, data access, or broader domain compromise.

How to detect it

To determine whether exploitation may have already occurred, focus on Print Spooler behavior, process creation, service changes, and lateral movement artifacts. Collect and review Windows Security logs, System logs, Microsoft-Windows-PrintService/Admin and Microsoft-Windows-PrintService/Operational logs, Sysmon or EDR telemetry, PowerShell logs, firewall logs, and authentication logs. Look for spoolsv.exe spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, bitsadmin.exe, or other command-and-control tooling. Investigate Print Spooler crashes, restarts, or repeated service failures around the same time as network spooler activity. Review new or modified files in Windows spool and printer driver directories, especially unexpected DLLs or executables. Search for low-privileged accounts making print/RPC connections to many hosts or to high-value servers. Correlate suspicious spooler events with Windows Security Event ID 4688 process creation, 4624 logons, 4672 special privilege assignment, 7045 service installation, scheduled task creation, registry autoruns, and EDR alerts for credential theft or lateral movement. Since no public exploit maturity or named threat actor activity is reported, absence of known exploit-specific strings does not rule out compromise; behavior-based detection is required.

• C:\Windows\System32\spoolsv.exe
• spoolsv.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\cmd.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\powershell.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\pwsh.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\wscript.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\cscript.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\mshta.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\rundll32.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\regsvr32.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\certutil.exe
• ParentImage: C:\Windows\System32\spoolsv.exe AND Image: *\bitsadmin.exe
• C:\Windows\System32\spool\PRINTERS\
• C:\Windows\System32\spool\drivers\x64\3\
• C:\Windows\System32\spool\drivers\W32X86\3\
• Microsoft-Windows-PrintService/Operational
• Microsoft-Windows-PrintService/Admin
• The Print Spooler service terminated unexpectedly
• Service Control Manager 7031
• Service Control Manager 7034
• Event ID 7045
• Event ID 4688
• Event ID 4624
• Event ID 4672

What your security team should do

• Prioritize patching or mitigation for Windows servers, print servers, domain controllers, administrative workstations, and systems reachable from broad internal network segments.
• Disable the Print Spooler service on any system that does not require local or network printing.
• Restrict network access to Print Spooler-related RPC/SMB services using Windows Defender Firewall, network firewalls, and segmentation controls.
• Inventory all Windows 10, Windows 11, and Windows Server assets to identify systems in the affected product list.
• Monitor for suspicious child processes spawned by spoolsv.exe, unexpected service creation, new scheduled tasks, and unusual outbound connections from spoolsv.exe.
• Review authentication and print-service logs for low-privileged accounts interacting with multiple hosts’ spooler services in a short period.
• Harden printer driver installation and Point and Print policies to reduce related print-spooler attack paths.
• Because the vulnerability is high severity but currently not KEV-listed and has low EPSS, align remediation with normal emergency/high-priority Windows patch cycles while prioritizing exposed and high-value hosts first.