CVE-2022-21999: high-severity vulnerability in Microsoft Windows 10 Version 1507
Windows Print Spooler Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply updates per vendor instructions.
A flaw in Windows Print Spooler allows a local attacker to gain higher system privileges on an affected computer. An attacker who exploits this vulnerability could run malicious code with administrative rights.
A path traversal vulnerability (CWE-22) combined with insecure file operations (CWE-59) in the Windows Print Spooler service allows a local authenticated attacker to execute arbitrary code with SYSTEM privileges. The vulnerability requires local access and exploitation can lead to complete system compromise.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.