CVE-2022-22718
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Description
CVE-2022-22718 is a privilege escalation vulnerability in the Microsoft Windows Print Spooler service, a system component responsible for managing print jobs and printer connections. This unspecified vulnerability allows a local attacker to elevate their privileges on affected Windows systems. The Windows Print Spooler has been a frequent target for privilege escalation attacks, and CVE-2022-22718 continues this trend with confirmed active exploitation. CISA has added CVE-2022-22718 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 10, 2022. The EPSS percentile of approximately 93% indicates very high exploitation probability, underscoring the urgency of patching this Print Spooler vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19204 |
| microsoft | windows 10 1607 | < 10.0.14393.4946 |
| microsoft | windows 10 1809 | < 10.0.17763.2565 |
| microsoft | windows 10 1909 | <= 10.0.18363.2094 |
| microsoft | windows 10 20h2 | < 10.0.19042.1526 |
| microsoft | windows 10 21h1 | < 10.0.19043.1526 |
| microsoft | windows 10 21h2 | < 10.0.19044.1526 |
| microsoft | windows 11 21h2 | < 10.0.22000.493 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4946 |
| microsoft | windows server 2019 | < 10.0.17763.2565 |
| microsoft | windows server 2022 | < 10.0.20348.524 |
| microsoft | windows server 20h2 | < 10.0.19042.1526 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22718(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22718(US Government Resource)
Weakness Type
Privilege Escalation in Windows Print Spooler
The vulnerability in the Microsoft Windows Print Spooler service involves an unspecified flaw that allows a locally authenticated attacker to escalate their privileges. The Print Spooler operates with SYSTEM-level privileges to manage print operations, and weaknesses in its handling of print-related requests, driver loading, or file operations can be exploited to execute code with elevated privileges.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2022-22718 requires local access to the target Windows system but no special privileges beyond a standard user account. Once successfully exploited, the attacker can escalate from limited user access to SYSTEM-level privileges through the Print Spooler service, gaining complete control over the operating system. The Windows Print Spooler is a particularly valuable attack target because it runs as a SYSTEM service on virtually all Windows installations and has a history of exploitable vulnerabilities. Successful privilege escalation through the Print Spooler enables an attacker to access all data on the system, install persistent backdoors, disable security software, and pivot to other systems on the network. The EPSS percentile of approximately 93% indicates very high exploitation activity, and CISA's inclusion in the KEV catalog confirms that this Print Spooler vulnerability is actively used in real-world attacks.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-22718 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 10, 2022. The EPSS percentile of approximately 93% indicates very high exploitation activity. The Windows Print Spooler has been one of the most targeted Windows components for privilege escalation, with a series of related vulnerabilities including PrintNightmare (CVE-2021-34527) drawing extensive attacker attention to the service. The continued exploitation of Print Spooler vulnerabilities demonstrates that mature exploitation techniques exist and are actively maintained by threat actors.
Remediation
-
Apply Microsoft security updates immediately as directed by CISA: "Apply updates per vendor instructions." Install the Windows security patch addressing the Print Spooler privilege escalation on all affected Windows systems through Windows Update or WSUS.
-
Disable the Print Spooler service on systems where printing is not required, particularly servers, domain controllers, and other high-value assets. Use Group Policy or PowerShell (
Stop-Service Spooler -Force; Set-Service Spooler -StartupType Disabled) to disable the service across your environment. -
Restrict Point and Print driver installation through Group Policy to prevent unprivileged users from installing print drivers, which is a common exploitation vector for Print Spooler vulnerabilities. Configure the "Package Point and Print - Approved Servers" policy to limit driver sources.
-
Monitor for Print Spooler exploitation indicators by enabling audit logging for Print Spooler events, monitoring for unexpected DLL loading by the spoolsv.exe process, and deploying EDR solutions that can detect privilege escalation through Print Spooler attack patterns.
-
Implement network-level restrictions on print traffic by blocking SMB (port 445) and RPC traffic between workstations and between workstations and servers where print sharing is not required, reducing the attack surface for Print Spooler exploitation through network segmentation.
Technical Details
CVE-2022-22718 is a privilege escalation vulnerability in the Microsoft Windows Print Spooler service (spoolsv.exe), which operates as a SYSTEM-level service responsible for managing local and network print operations. The unspecified vulnerability allows a locally authenticated attacker to exploit a flaw in the Print Spooler's handling of print-related operations to execute code with SYSTEM privileges. Print Spooler vulnerabilities of this nature typically involve improper validation of driver installation requests, file operation race conditions, or privilege handling flaws during print job processing. The local attack vector means this vulnerability is used as a privilege escalation stage in multi-step attacks, and its exploitation has been particularly common following the extensive research into Print Spooler security triggered by the PrintNightmare vulnerability series.
Frequently Asked Questions
Is CVE-2022-22718 being actively exploited?
Yes, CVE-2022-22718 is being actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 10, 2022. The EPSS percentile of approximately 93% confirms very high exploitation activity.
What products are affected by CVE-2022-22718?
CVE-2022-22718 affects Microsoft Windows systems that run the Print Spooler service. Since the Print Spooler is enabled by default on virtually all Windows installations, the vulnerability has a very broad impact across Windows client and server editions.
How do I fix CVE-2022-22718?
Apply the Microsoft security update that addresses the Print Spooler vulnerability. On systems where printing is not needed, disable the Print Spooler service entirely. Restrict print driver installation through Group Policy and deploy EDR solutions to detect exploitation attempts.
How severe is CVE-2022-22718?
CVE-2022-22718 is a high-severity privilege escalation vulnerability with an EPSS percentile of approximately 93%. The Print Spooler flaw enables attackers to escalate from standard user access to SYSTEM-level privileges on virtually any Windows system, and it is part of the broader pattern of Print Spooler vulnerabilities that have been heavily targeted by threat actors.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.