CISA adds Win Print Spooler to Known Exploited Vulnerabilities Catalog

CVE-2022-22718 is an elevation of privilege vulnerability in the Microsoft Windows Print Spooler service, the component that manages printing and print queues on Windows systems. A local attacker who can already execute low-privileged code on a vulnerable machine can exploit the flaw with no user interaction required. Successful exploitation grants elevated (SYSTEM-level) privileges, giving the attacker full control of the compromised host. The affected range spans essentially the entire supported Windows installed base at the time of disclosure, including Windows 7 through Windows 11 21H2 and Windows Server 2008. The flaw is known to be exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-19 and carries an 18.5% EPSS probability of exploitation within 30 days (97th percentile), though no public proof-of-concept is catalogued and ransomware use is listed as unknown.

Do: Apply Microsoft's security updates (released with the February 2022 Patch Tuesday and later cumulative updates) to every affected Windows system, per CISA's required action to update per vendor instructions; Windows 7 and 8.1 may require extended-security-update coverage. Prioritize multi-user and high-value hosts such as domain controllers, Remote Desktop Session Hosts, and print servers, where a local privilege escalation to SYSTEM is most impactful. As an interim mitigation where patching is delayed, consider disabling the Print Spooler service on systems that do not need printing.