CVE-2022-21919: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows User Profile Service Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A flaw in Windows User Profile Service allows an attacker to gain higher privileges than they should have on a system. This matters because it could let someone take control of sensitive system functions and access other users' data.
CWE-59 (Improper Link Resolution Before File Access) in the Windows User Profile Service allows local attackers to escalate privileges through symlink or junction point manipulation during profile directory operations. Exploitation requires local access but no special privileges, and successful exploitation grants SYSTEM-level code execution.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.