Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2022-38028)
Published In CISA KEV since Sources: pwn.watch, CVE.org
What is affected, what to do
Windows Print Spooler Elevation of Privilege Vulnerability
The vulnerability is being actively exploited; treat it as a priority. Update Microsoft Windows 10 Version 1809 to version 10.0.17763.3532, Microsoft Windows Server 2019 to version 10.0.17763.3532, Microsoft Windows Server 2019 (Server Core installation) to version 10.0.17763.3532. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- Microsoft Windows 10 Version 1809
lt 10.0.17763.0..10.0.17763.3532 - Microsoft Windows Server 2019
lt 10.0.17763.0..10.0.17763.3532 - Microsoft Windows Server 2019 (Server Core installation)
lt 10.0.17763.0..10.0.17763.3532 - Microsoft Windows 10 Version 21H1
lt 10.0.0..10.0.19043.2130 - Microsoft Windows Server 2022
lt 10.0.20348.0..10.0.20348.1129 - Microsoft Windows 10 Version 20H2
lt 10.0.0..10.0.19042.2130 - Microsoft Windows 11 version 21H2
lt 10.0.0..10.0.22000.1098 - Microsoft Windows 10 Version 21H2
lt 10.0.19043.0..10.0.19044.2130 - Microsoft Windows 11 version 22H2
lt 10.0.22621.0..10.0.22621.674 - Microsoft Windows 10 Version 1507
lt 10.0.10240.0..10.0.10240.19507 - Microsoft Windows 10 Version 1607
lt 10.0.14393.0..10.0.14393.5427 - Microsoft Windows Server 2016
lt 10.0.14393.0..10.0.14393.5427 - Microsoft Windows Server 2016 (Server Core installation)
lt 10.0.14393.0..10.0.14393.5427 - Microsoft Windows 8.1
lt 6.3.0..6.3.9600.20625 - Microsoft Windows Server 2012
lt 6.2.9200.0..6.2.9200.23920 - Microsoft Windows Server 2012 (Server Core installation)
lt 6.2.9200.0..6.2.9200.23920 - Microsoft Windows Server 2012 R2
lt 6.3.9600.0..6.3.9600.20625 - Microsoft Windows Server 2012 R2 (Server Core installation)
lt 6.3.9600.0..6.3.9600.20625
- Microsoft Windows 10 Version 1809
- Fixed in
- Microsoft Windows 10 Version 1809
10.0.17763.3532 - Microsoft Windows Server 2019
10.0.17763.3532 - Microsoft Windows Server 2019 (Server Core installation)
10.0.17763.3532 - Microsoft Windows 10 Version 21H1
10.0.19043.2130 - Microsoft Windows Server 2022
10.0.20348.1129 - Microsoft Windows 10 Version 20H2
10.0.19042.2130 - Microsoft Windows 11 version 21H2
10.0.22000.1098 - Microsoft Windows 10 Version 21H2
10.0.19044.2130 - Microsoft Windows 11 version 22H2
10.0.22621.674 - Microsoft Windows 10 Version 1507
10.0.10240.19507 - Microsoft Windows 10 Version 1607
10.0.14393.5427 - Microsoft Windows Server 2016
10.0.14393.5427 - Microsoft Windows Server 2016 (Server Core installation)
10.0.14393.5427 - Microsoft Windows 8.1
6.3.9600.20625 - Microsoft Windows Server 2012
6.2.9200.23920 - Microsoft Windows Server 2012 (Server Core installation)
6.2.9200.23920 - Microsoft Windows Server 2012 R2
6.3.9600.20625 - Microsoft Windows Server 2012 R2 (Server Core installation)
6.3.9600.20625
- Microsoft Windows 10 Version 1809
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
7.8
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
7.8
CVSS v3
Severity High on the scale from 0 to 10.
Source: pwn.watch, CVE.org
15.0 %
EPSS score
Elevated — model estimates 10-50% exploitation likelihood.
Source: FIRST EPSS, percentile 96.7
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 215.34 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploited
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 7.8 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 7.8
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 15.0 %
- Elevated — model estimates 10-50% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 96.7
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- CISA assessment (SSVC)
- Exploitation: active · not automatable · Technical impact: total
- Source: CISA Vulnrichment, as of 2 May 2024
Response and mitigation
Why act now?
Prioritisation rationale
The flaw is local-only, but it needs only low privileges and no user interaction, and it ends in full SYSTEM compromise. That makes it a textbook second-stage tool after phishing or credential theft. CISA added it to KEV long after the fix shipped, which signals that targeted actors deliberately harvest unpatched legacy estates. Exploitation likelihood is very high, while CISA does not currently flag ransomware use. If your fleet is current, the main job is retrospective hunting. Any unpatched client, especially admin endpoints or systems at government and KRITIS interfaces, should be rated high priority and treated as evidence of a patch-management gap.
Runbook step 1
Immediate response (0-24 h)
- Verify patch level and deploy the October 2022 security update (or any later cumulative update). Minimum fixed builds per the advisory: Win10 1507
10.0.10240.19507, 160710.0.14393.5427, 180910.0.17763.3532, 20H210.0.19042.2130, 21H110.0.19043.2130, 21H210.0.19044.2130, Win11 21H210.0.22000.1098, 22H210.0.22621.674. Look up the KB IDs in the vendor advisory, and check Server SKUs separately in Microsoft's advisory. - Inventory the stragglers. Any client below these builds has been unpatched for well over a year. Treat it as a patch-governance finding and push it to the top of the compromise-assessment queue.
- Disable the Print Spooler wherever printing is not required. This applies above all to domain controllers, jump hosts, admin workstations and servers. Run
Stop-Service Spooler -Force; Set-Service Spooler -StartupType Disabledand enforce it via GPO. - Kick off a retrospective hunt. Look for copies or modifications of
MPDW-constraints.jsoutside the DriverStore and for shells spawned byspoolsv.exe(see Detection rules). This flaw is a post-initial-access tool, so a hit means you are already compromised. - On a hit: isolate the host, rotate local admin and service account credentials (reset the LAPS password), and treat any domain credentials cached on that host as burned.
- Verify patch level and deploy the October 2022 security update (or any later cumulative update). Minimum fixed builds per the advisory: Win10 1507
Runbook step 2
Mitigation layers
- Configuration: Disable the GPO "Allow Print Spooler to accept client connections". Enforce Point and Print restrictions with
RestrictDriverInstallationToAdministrators=1underHKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint. This shrinks the spooler attack surface but does not replace the patch. - Endpoint hardening: Enable Defender ASR rules, notably "Block process creations originating from PSExec and WMI commands" and "Block abuse of exploited vulnerable signed drivers". Use WDAC or AppLocker to block unsigned binaries and DLLs from
C:\ProgramData\and%TEMP%, which is where the publicly documented exploit chain stages its redirection structure and payloads. - File system monitoring: Configure SACL auditing on
C:\Windows\System32\DriverStore\FileRepository\for write and modify access. Also monitor the creation of directory junctions and symbolic links underC:\ProgramData. - IAM / least privilege: Exploitation only needs a low-privileged local account, so raise the cost of initial access. Separate user and admin accounts, deploy LAPS, apply the tiered admin model, and strip local admin rights from end users.
- Network segmentation: Block client-to-client SMB/RPC (
445/tcp,135/tcp) to contain lateral movement once SYSTEM has been obtained.
- Configuration: Disable the GPO "Allow Print Spooler to accept client connections". Enforce Point and Print restrictions with
Runbook step 3
Detection rules
- Sysmon EID 11 / MDE DeviceFileEvents:
MPDW-constraints.jswritten outside the legitimate DriverStore path. KQL:DeviceFileEvents | where FileName =~ "MPDW-constraints.js" and FolderPath !startswith @"C:\Windows\System32\DriverStore\" - Process ancestry (Sysmon EID 1 / Security 4688):
spoolsv.exespawningcmd.exe,powershell.exe,rundll32.exeorwscript.exe. KQL:DeviceProcessEvents | where InitiatingProcessFileName =~ "spoolsv.exe" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","wscript.exe") - Sysmon EID 7 (image load):
spoolsv.exeloading DLLs from non-standard paths such asC:\ProgramData\*or user profiles. Sigma shape:Image|endswith: '\spoolsv.exe'ANDImageLoaded|startswith: 'C:\ProgramData\' - Persistence: Security event 4698 (scheduled task created) or Sysmon EID 1 showing
schtasks.exe /createthat launches batch files fromC:\ProgramDataas SYSTEM. Treat this as high-confidence when it correlates with Print Spooler service restarts (System event 7036). - Registry (Sysmon EID 13): New or modified values under
HKLM\SYSTEM\CurrentControlSet\Control\Print\orHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\written by non-system processes.
- Sysmon EID 11 / MDE DeviceFileEvents:
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Windows Print Spooler Elevation of Privilege Vulnerability
Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
| Affected versions | Fixed in | ||
|---|---|---|---|
| Microsoft | Windows 10 Version 1507 |
|
|
| Microsoft | Windows 10 Version 1607 |
|
|
| Microsoft | Windows 10 Version 1809 |
|
|
| Microsoft | Windows 10 Version 20H2 |
|
|
| Microsoft | Windows 10 Version 21H1 |
|
|
| Microsoft | Windows 10 Version 21H2 |
|
|
| Microsoft | Windows 11 version 21H2 |
|
|
| Microsoft | Windows 11 version 22H2 |
|
|
| Microsoft | Windows 8.1 |
|
|
| Microsoft | Windows Server 2012 |
|
|
| Microsoft | Windows Server 2012 (Server Core installation) |
|
|
| Microsoft | Windows Server 2012 R2 |
|
|
| Microsoft | Windows Server 2012 R2 (Server Core installation) |
|
|
| Microsoft | Windows Server 2016 |
|
|
| Microsoft | Windows Server 2016 (Server Core installation) |
|
|
| Microsoft | Windows Server 2019 |
|
|
| Microsoft | Windows Server 2019 (Server Core installation) |
|
|
| Microsoft | Windows Server 2022 |
|
|
Vendors and products
- Microsoft Windows 10 1507
- Microsoft Microsoft Windows 10 1607
- Microsoft Microsoft Windows 10 1809
- Microsoft Windows 10 20h2
- Microsoft Windows 10 21h1
- Microsoft Microsoft Windows 10 21H2
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 20h2
- Microsoft Windows 10 Version 21h1
- Microsoft Windows 10 Version 21h2
Affected operating systems
| Windows | microsoft | windows_10_1507 | — |
| Windows | microsoft | windows_10_1607 | — |
| Windows | microsoft | windows_10_1809 | — |
| Windows | microsoft | windows_10_20h2 | — |
| Windows | microsoft | windows_10_21h1 | — |
| Windows | microsoft | windows_10_21h2 | — |
| Windows | microsoft | windows_11_22h2 | — |
| Windows | microsoft | windows_8.1 | — |
| Windows | microsoft | windows_rt_8.1 | — |
| Windows | microsoft | windows_server_2012 | r2 |
| Windows | microsoft | windows_server_2012 | — |
| Windows | microsoft | windows_server_2016 | — |
| Windows | microsoft | windows_server_2019 | — |
| Windows | microsoft | windows_server_2022 | — |
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited |
References & sources
- Microsoft Security Update GuideWindows Print Spooler Elevation of Privilege VulnerabilityVendor advisory, Patch, Vendor advisory, pwn-watch
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-38028government-resource, US government resource
- portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2022-38028x_transferred, Patch, Vendor advisory
- pwn.watchpwn.watch: Microsoft Windows Print Spooler Privilege Escalationpwn-watch
- NVD (NIST)NVD: CVE-2022-38028pwn-watch
- cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2022-38028"><img src="https://intel.neosec.eu/badge/cve/CVE-2022-38028.svg?lang=en" alt="CVE-2022-38028 – NEOSEC Intel" height="20"></a>