CVE-2022-21919
Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Description
CVE-2022-21919 is a privilege escalation vulnerability in the Microsoft Windows User Profile Service that allows a local attacker to elevate their privileges on affected Windows systems. This unspecified vulnerability in the Windows User Profile Service can be exploited by an authenticated user to gain higher-level access, potentially reaching SYSTEM privileges and full control over the operating system. CISA has added CVE-2022-21919 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022, confirming active exploitation in the wild. The EPSS percentile of approximately 49% indicates a moderate probability of exploitation, though the KEV listing confirms that real-world attacks are occurring.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19177 |
| microsoft | windows 10 1607 | < 10.0.14393.4886 |
| microsoft | windows 10 1809 | < 10.0.17763.2452 |
| microsoft | windows 10 1909 | < 10.0.18363.2037 |
| microsoft | windows 10 20h2 | < 10.0.19042.1466 |
| microsoft | windows 10 21h1 | < 10.0.19043.1466 |
| microsoft | windows 10 21h2 | < 10.0.19044.1466 |
| microsoft | windows 11 21h2 | < 10.0.22000.434 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4886 |
| microsoft | windows server 2019 | < 10.0.17763.2452 |
| microsoft | windows server 2022 | < 10.0.20348.469 |
| microsoft | windows server 20h2 | < 10.0.19042.1466 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21919(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21919(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21919(US Government Resource)
Weakness Type
Privilege Escalation in Windows User Profile Service
The vulnerability in the Microsoft Windows User Profile Service involves an unspecified flaw that enables a locally authenticated attacker to escalate their privileges beyond their assigned access level. The User Profile Service handles user profile operations during Windows logon sessions, and weaknesses in its processing logic can be abused to execute code with elevated privileges, bypassing standard access controls.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2022-21919 requires local access and at least low-level authentication on the target system, meaning an attacker must first establish a foothold before exploiting this vulnerability. Once successfully exploited, the attacker can escalate from a limited user account to elevated privileges, potentially gaining SYSTEM access that provides complete control over the Windows operating system, including the ability to access sensitive data, install software, modify system configurations, and create new privileged accounts. The EPSS percentile of approximately 49% indicates moderate exploitation probability, while CISA's inclusion in the KEV catalog confirms that threat actors have successfully used this User Profile Service privilege escalation in real-world attacks. This vulnerability is particularly valuable in attack chains where initial access is obtained through phishing or other remote vectors, and privilege escalation is needed to achieve full system compromise.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-21919 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 49% suggests moderate but real exploitation activity, indicating that while mass exploitation may not be widespread, targeted attacks leveraging this Windows User Profile Service vulnerability are occurring. The confirmed KEV listing means that at minimum, government agencies are required to patch this vulnerability, and all organizations should treat it as a priority given the demonstrated real-world exploitation.
Remediation
-
Apply Microsoft security updates immediately as directed by CISA: "Apply updates per vendor instructions." Install the Windows security patch addressing the User Profile Service privilege escalation on all affected Windows versions through Windows Update or WSUS.
-
Verify patch deployment across all Windows systems in your environment, prioritizing systems with multiple user accounts, shared workstations, and servers accessible through remote access solutions such as RDP or VPN.
-
Enforce least privilege access controls by removing unnecessary local administrator privileges, implementing Group Policy restrictions on User Profile Service operations, and deploying application whitelisting to prevent execution of unauthorized code.
-
Enable enhanced security monitoring by configuring Windows event logging for privilege escalation events (Event IDs 4672, 4673, 4674), deploying EDR solutions capable of detecting User Profile Service exploitation patterns, and setting up alerts for unexpected privilege changes.
-
Implement defense-in-depth measures including network segmentation to limit lateral movement after privilege escalation, multi-factor authentication for all privileged access, and regular security assessments to identify and close potential attack chains that could leverage this vulnerability.
Technical Details
CVE-2022-21919 is a privilege escalation vulnerability in the Microsoft Windows User Profile Service, a system component responsible for managing user profile loading, unloading, and maintenance during Windows logon sessions. The unspecified nature of the vulnerability indicates a flaw in how the User Profile Service handles profile operations, which can be abused by a locally authenticated attacker to execute code with elevated privileges. The attack requires local access with low-level privileges and no user interaction beyond the attacker's own session, making it a reliable post-compromise escalation technique. This type of User Profile Service vulnerability typically involves race conditions, improper permission checks, or symbolic link following during profile operations that allow an attacker to hijack privileged file operations performed by the SYSTEM account.
Frequently Asked Questions
Is CVE-2022-21919 being actively exploited?
Yes, CVE-2022-21919 is being actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 49% indicates moderate exploitation probability with confirmed real-world attacks.
What products are affected by CVE-2022-21919?
CVE-2022-21919 affects Microsoft Windows systems that use the User Profile Service component. Multiple Windows versions are impacted. All Windows installations without the corresponding security update remain vulnerable to this privilege escalation.
How do I fix CVE-2022-21919?
Apply the Microsoft security update through Windows Update or WSUS on all affected Windows systems. Enforce least privilege access controls and deploy EDR solutions to detect exploitation attempts. Verify patch deployment across your entire Windows environment.
How severe is CVE-2022-21919?
CVE-2022-21919 is a significant privilege escalation vulnerability with an EPSS percentile of approximately 49% and confirmed active exploitation. While it requires local access, it enables attackers to escalate to SYSTEM-level privileges and is commonly used in multi-stage attack chains following initial compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.