CVE-2022-22718: Windows Print Spooler local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and a high EPSS percentile, though it requires local low-privileged access rather than being remotely exploitable.

What it is

CVE-2022-22718 is an elevation of privilege flaw in the Windows Print Spooler. A local attacker with low privileges can exploit it to gain higher privileges on the host. It affects a broad range of Windows client and server versions, making it relevant to most Windows estates.

Impact

An attacker who already holds a low-privileged account can escalate to SYSTEM-level rights on the affected machine. That level of access enables full control of the host, including credential theft and disabling of security controls.

Attack surface

The CVSS vector is AV:L/PR:L/UI:N, so the flaw is reached locally by an authenticated low-privileged user and requires no user interaction. It is not remotely reachable over the network per the supplied vector.

Exploitation

CISA added it to the KEV catalog on 2022-04-19 with a remediation due date of 2022-05-10, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.18464 (97th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft updates referenced in the MSRC advisory for CVE-2022-22718 across all listed Windows client and server versions.
• Prioritize patching of internet-facing and multi-user systems such as terminal servers and Windows Server 2019/2022 hosts.
• Restrict local logon and interactive access to only trusted users to reduce the pool of accounts that can trigger the flaw.
• Where the Print Spooler service is not required, disable it to remove the attack surface.
• Track KEV remediation deadlines and verify patching through inventory or vulnerability scanning.

Detection

• Monitor for unexpected creation of SYSTEM-level processes or services spawned from low-privileged user sessions.
• Alert on suspicious access or modification of Print Spooler service binaries and spooler-related registry keys.
• Correlate local privilege escalation events (for example, token or process creation anomalies) with recent spooler activity.
• Audit hosts still running unpatched Windows builds from the affected product list.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.