CVE-2022-26904
Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Description
CVE-2022-26904 is a privilege escalation vulnerability in the Microsoft Windows User Profile Service that allows a local attacker to elevate their privileges on affected systems. The unspecified flaw in the Windows User Profile Service can be exploited by an authenticated user with low-level access to gain elevated privileges, potentially achieving SYSTEM-level control. CISA has added CVE-2022-26904 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022, confirming active exploitation in the wild. The EPSS percentile of approximately 96% indicates a very high probability of exploitation, making this a high-priority patching target for Windows environments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19265 |
| microsoft | windows 10 1607 | < 10.0.14393.5066 |
| microsoft | windows 10 1809 | < 10.0.17763.2803 |
| microsoft | windows 10 1909 | < 10.0.18363.2212 |
| microsoft | windows 10 20h2 | < 10.0.19042.1645 |
| microsoft | windows 10 21h1 | < 10.0.19043.1645 |
| microsoft | windows 10 21h2 | < 10.0.19044.1645 |
| microsoft | windows 11 21h2 | < 10.0.22000.613 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5066 |
| microsoft | windows server 2019 | < 10.0.17763.2803 |
| microsoft | windows server 2022 | < 10.0.20348.643 |
| microsoft | windows server 20h2 | < 10.0.19042.1645 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26904(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26904(US Government Resource)
Weakness Type
Privilege Escalation in Windows User Profile Service
The vulnerability in the Microsoft Windows User Profile Service involves an unspecified flaw that allows a locally authenticated attacker to escalate their privileges. The User Profile Service manages user profiles during logon and session management, and weaknesses in its handling of profile operations can be exploited to execute code with elevated privileges.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2022-26904 requires local access to the system, meaning an attacker must first have a foothold on the target machine with at least low-level user privileges. However, once exploitation is successful, the attacker can escalate to higher privilege levels, potentially gaining SYSTEM access that provides full control over the Windows operating system. This privilege escalation vulnerability is particularly dangerous when chained with initial access vulnerabilities such as phishing or remote code execution flaws, as it allows attackers to move from limited user access to complete system control. The EPSS percentile of approximately 96% indicates very high exploitation activity, and CISA's inclusion in the KEV catalog confirms that threat actors are actively using this Windows User Profile Service vulnerability in real-world attack chains.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-26904 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 96% indicates very high exploitation activity, placing this vulnerability among the most actively exploited Windows privilege escalation flaws. The combination of confirmed active exploitation, high EPSS score, and the common use of privilege escalation in multi-stage attack chains makes CVE-2022-26904 a critical component in the arsenal of threat actors targeting Windows environments.
Remediation
-
Apply Microsoft security updates immediately as directed by CISA: "Apply updates per vendor instructions." Install the Windows security patch that addresses the User Profile Service privilege escalation vulnerability on all affected Windows versions through Windows Update or WSUS.
-
Prioritize patching for systems with multiple users or external-facing services, as these are most likely to be targeted for privilege escalation after an initial compromise. Focus on servers, shared workstations, and systems accessible through remote desktop or VPN connections.
-
Implement least privilege principles to minimize the impact of privilege escalation attacks. Remove unnecessary local administrator access, use Group Policy to restrict User Profile Service interactions, and deploy application control solutions to prevent execution of unauthorized binaries.
-
Monitor for privilege escalation indicators by enabling Windows security event logging, particularly Event IDs related to privilege changes (4672, 4673, 4674) and User Profile Service operations. Deploy EDR solutions that can detect anomalous privilege escalation patterns in Windows environments.
-
Segment and harden Windows systems by implementing network micro-segmentation, restricting lateral movement between workstations and servers, and enforcing multi-factor authentication for all privileged access to reduce the impact of successful privilege escalation.
Technical Details
CVE-2022-26904 is a privilege escalation vulnerability in the Microsoft Windows User Profile Service, which is responsible for managing user profile loading, creation, and deletion during Windows logon sessions. The unspecified vulnerability allows a locally authenticated attacker with low-level privileges to exploit a flaw in the User Profile Service to execute code with elevated privileges. The local attack vector means that remote exploitation is not possible through this vulnerability alone, but it is commonly used as a second-stage exploit after gaining initial access through a separate vulnerability or social engineering attack. The privilege escalation can be achieved without requiring any user interaction beyond the attacker's own authenticated session, making it reliable and repeatable once local access is obtained.
Frequently Asked Questions
Is CVE-2022-26904 being actively exploited?
Yes, CVE-2022-26904 is being actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 16, 2022. The EPSS percentile of approximately 96% confirms very high exploitation activity.
What products are affected by CVE-2022-26904?
CVE-2022-26904 affects Microsoft Windows systems that use the User Profile Service component. Multiple versions of Windows are affected. All Windows installations that have not applied the corresponding security update remain vulnerable to this privilege escalation flaw.
How do I fix CVE-2022-26904?
Apply the Microsoft security update that addresses the Windows User Profile Service vulnerability through Windows Update or WSUS. Implement least privilege principles to reduce the impact of privilege escalation and deploy EDR solutions to detect exploitation attempts.
How severe is CVE-2022-26904?
CVE-2022-26904 is a high-severity privilege escalation vulnerability with an EPSS percentile of approximately 96%. While it requires local access, it enables attackers to escalate from low-level user privileges to full system control and is commonly used in multi-stage attack chains following initial compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.