CVE-2022-22047: Windows CSRSS elevation of privilege via untrusted search path

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a local privilege escalation with high impact across many Windows versions and confirmed active exploitation per CISA KEV, though it requires an existing local foothold.

What it is

CVE-2022-22047 is an elevation of privilege flaw in the Windows Client Server Run-time Subsystem (CSRSS), classified as CWE-426 (untrusted search path). A local attacker with low privileges can exploit it to gain full control of confidentiality, integrity and availability on the host. It affects a broad range of Windows client and server releases, and CISA added it to the Known Exploited Vulnerabilities catalog, so it is being used in the wild.

Impact

An attacker who already has a foothold on the machine can elevate from a low-privileged user to SYSTEM-level code execution. That yields full control of the host, enabling credential theft, disabling of defenses and lateral movement.

Attack surface

The CVSS vector is local (AV:L), low complexity, low privileges required and no user interaction (PR:L/UI:N), so the attacker must already be able to run code on the target. It is not remotely reachable and does not depend on tricking a user into opening a file.

Exploitation

CISA added it to KEV on 2022-07-12 with a remediation due date of 2022-08-02, confirming active exploitation; EPSS gives a 30-day probability of about 18.8 percent (97th percentile). No ransomware campaign use is recorded and no public exploit references are listed beyond the vendor advisory and KEV entry.

What to do

• Apply the Microsoft updates referenced in the MSRC advisory for CVE-2022-22047 as the first action, covering all listed Windows client and server versions.
• Prioritize patching of internet-facing and high-value servers (Windows Server 2008 through 2022) and any Windows 10/11 endpoints, since KEV status means exploitation is ongoing.
• Enforce least privilege so that standard users cannot run arbitrary code locally, reducing the precondition for this local privilege escalation.
• Harden service and executable search paths and monitor for writable directories that could be abused for untrusted search path loading.
• Track KEV remediation deadlines and verify patch compliance across the full affected product list rather than a subset.

Detection

• Monitor for unexpected processes spawning from or interacting with CSRSS, especially non-system binaries loading from user-writable paths.
• Alert on privilege escalation from a standard user context to SYSTEM, for example new SYSTEM-level processes or services created by non-admin users.
• Audit file creation in writable directories that are searched by system services, looking for DLL or executable drops consistent with search path hijacking.
• Correlate local logon events with subsequent SYSTEM-level process creation on the same host to spot post-exploitation elevation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.