CVE-2022-21919

moderate-risk

Published 2022-01-11

Windows User Profile Service Elevation of Privilege Vulnerability

Do I need to act?

0.31% chance of exploitation

EPSS score — low exploit probability

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.0/10 High

LOCAL / HIGH complexity

Windows 10 1507

Windows 10 1607

Windows 10 1809

Windows 10 1909

Windows 10 20H2

Windows 10 21H1

Windows 10 21H2

Windows 11 21H2

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2012

Windows Server 2016

Windows Server 2019

Microsoft

Patch https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21919

Vendor Advisory https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-2191...

US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-...

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 8/34 · Low

Exposure 20/34 · Moderate