Patchfirst
Patchfirst
CVE-2022-38028 KEV High · 7.8 EPSS 14.9%

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Microsoft · Windows

Summary

The Windows Print Spooler component of Microsoft Windows contains a privilege escalation flaw. An attacker who already has low-privileged local access to the system can exploit it to elevate their privileges, requiring no user interaction.

Official description · NVD

Windows Print Spooler Elevation of Privilege Vulnerability

Breakdown
68.9 / 100
Exploited
Yes, in CISA KEV
Reports
2
Tactics
1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

First seen exploited 18 months after disclosure.

  1. First dated threat reportmicrosoft.com12 mo before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+18 mo
  4. Added to CISA KEVEU database agrees+18 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

1 , grouped by in kill-chain order, 1 cited passage 1

Privilege EscalationTA0004

Exploitation for Privilege Escalation T1068 Medium
AI mapping from the description · how it is exploited

Local privilege escalation via Print Spooler flaw

Windows Print Spooler Elevation of Privilege Vulnerability
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 31 general rules for its techniques

Rules for this CVE

0 that reference CVE-2022-38028 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploitation for Privilege EscalationT106831 general rules
All 31 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 2 threat reports
2 reportsVolexityMicrosoftOct 2021 – Nov 2024

Reports are matched by finding the exact id CVE-2022-38028 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag

Vendor Advisory 2

msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38028portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38028

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38028
↑ ↓ chooseEnter openEsc close