Vulnerability record · CVE-2010-2729 · published 15 September 2010
CVE-2010-2729: Windows Print Spooler permission validation flaw enables remote code execution
Microsoft · Windows 7
The Windows Print Spooler service fails to properly validate spooler access permissions when printer sharing is enabled, allowing a remote attacker to create files in a system directory. This file creation can be leveraged to execute arbitrary code, and the flaw was exploited in the wild in September 2010.
Description
The Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when printer sharing is enabled, does not properly validate spooler access permissions, which allows remote attackers to create files in a system directory, and consequently execute arbitrary code, by sending a crafted print request over RPC, as exploited in the wild in September 2010, aka "Print Spooler Service Impersonation Vulnerability."
AV:N/AC:M/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityRemote unauthenticated code execution with high EPSS and confirmed in-the-wild exploitation makes this an urgent patching priority.
What it is
The Windows Print Spooler service fails to properly validate spooler access permissions when printer sharing is enabled, allowing a remote attacker to create files in a system directory. This file creation can be leveraged to execute arbitrary code, and the flaw was exploited in the wild in September 2010.
Impact
A remote, unauthenticated attacker can execute arbitrary code with system privileges on the affected host. This gives full control of the machine, including data theft, installation of malware, and lateral movement.
Attack surface
The vulnerability is reached over RPC by sending a crafted print request to the spooler service. No authentication is required, but printer sharing must be enabled on the target, and the CVSS vector indicates medium attack complexity.
Exploitation
The description states the flaw was exploited in the wild in September 2010. It is not listed in CISA KEV, but EPSS is very high at 0.756 (99.5th percentile), indicating significant observed exploitation activity.
What to do
- Apply the Microsoft security update MS10-061 immediately on all affected Windows versions.
- Disable printer sharing on systems that do not require it.
- Block RPC ports (especially TCP 445 and the dynamic RPC range) at network boundaries where feasible.
- Restrict network access to the print spooler service to trusted hosts only.
- Monitor for and remove any unexpected files created in system directories by the spooler.
Detection
- Monitor for unexpected file creation in system directories (e.g., C:\Windows\System32) by the spooler process (spoolsv.exe).
- Audit RPC traffic to the print spooler service for anomalous or crafted print requests.
- Check for the presence of known exploit artifacts or unusual files in spooler-related directories.
- Review Windows event logs for spooler service errors or unexpected service behavior.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-2729 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-2729), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
