CVE-2022-26904 is an user profile service privilege escalation vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 April 2022, which means attackers have used it in real attacks. Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
What this vulnerability means
CVE-2022-26904 is a Microsoft Windows User Profile Service privilege escalation issue, which means a lower-privileged attacker can potentially gain higher rights on the affected system. That makes the vulnerability especially dangerous on endpoints where local access, weak segmentation, or reused admin sessions can turn one foothold into full host control.
In practical terms, privilege escalation is often the bridge between initial compromise and wider impact. Attackers may use it to disable security tools, harvest additional credentials, tamper with logs, or stage lateral movement after they have already landed on a machine.
Why exploited Windows privilege escalation matters
Microsoft Windows privilege escalation flaws are valuable because they reduce the effort needed to move from code execution or user access to administrative control. Once an attacker can raise privileges, the host becomes far easier to manipulate, and any stored secrets, cached credentials, or privileged sessions on that system may be exposed.
Because this CVE was added to CISA’s Known Exploited Vulnerabilities catalogue, organisations should treat it as an active exposure rather than a theoretical weakness. For version and patch specifics, rely on the CVE Program record and the NIST National Vulnerability Database entry rather than reproducing them from memory.
How organisations assess exposure and reduce impact
Exposure checks should start with asset inventory, because the key question is not only whether Windows is present, but which systems are reachable, internet-exposed, or likely to be targeted first. Priority should rise on endpoints used by administrators, jump hosts, remote access systems, and machines that handle sensitive credentials or support privileged workflows.
Compensating controls matter when patching is delayed. Reduce local administrative use, constrain interactive logons, segment high-value systems, and monitor for unusual privilege changes or security-tool tampering. The Vulnerability Management Guide is useful here because it ties KEV-driven prioritisation to asset scope, remediation SLAs, and verification.
Detection and post-compromise review
Detection should focus on signs that a user-level compromise has crossed into administrative control. That includes unexpected process creation with elevated rights, new local administrators, service changes, disabled protections, and unusual activity immediately after logon or remote access.
After patching, review the host for evidence of follow-on abuse rather than assuming the system is clean. Use MITRE ATT&CK Enterprise Matrix to map privilege escalation, credential access, and lateral movement behaviours, then validate whether the system was used to access other endpoints or harvest secrets. If the host carried administrative credentials, those credentials should be treated as potentially exposed and rotated as needed.
Risk and Threat Considerations
Privilege escalation flaws on Windows are high-value because they compress the attacker path from a narrow foothold into durable control of the machine. That can expose local secrets, open the door to lateral movement, and make incident containment harder once an attacker can act as an administrator.
Failure mechanism: A successful exploit raises the attacker’s rights inside the operating system, allowing them to interfere with security controls, access protected resources, or pivot to additional systems from the compromised host.
Impact: Organisations may face broader endpoint compromise, credential exposure, and faster propagation of an intrusion beyond the original user context.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Windows privilege escalation is a flaw remediation problem. |
| AC-6 — Least Privilege | The vulnerability is dangerous because excessive privilege enables host takeover. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on detecting abnormal privilege changes and hostile actions. | |
| Recommendation — Prioritise remediation of known privilege escalation flaws and verify fixes on exposed Windows assets. Limit local administrative rights and reduce standing privilege on Windows endpoints. Review audit records for privilege escalation, account changes, and follow-on abuse after suspected exploitation. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed CVEs require disciplined vulnerability tracking and prioritisation. |
| Recommendation — Track the CVE in your vulnerability programme and accelerate remediation on in-scope Windows systems. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The term directly names an attacker technique for gaining higher privileges. |
| Recommendation — Map alerts and hunt logic to privilege escalation behaviours on Windows hosts. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed privilege escalation issues as operationally urgent even when the vulnerable host is not internet-facing. A single local escalation path can still become critical if the system is used for administration, remote support, or access to sensitive data.
What to watch for: Prioritise systems with privileged users, remote access tooling, and weak containment boundaries. If the affected host cannot be patched immediately, tighten local privilege assignments, increase monitoring, and shorten the time window in which elevated access can be abused.
Related resources from NHI Mgmt Group
- CVE-2022-41125 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
- CVE-2022-41033 (Microsoft Windows COM+ Event System Service Privilege Escalation)
- CVE-2022-38028 (Microsoft Windows Print Spooler Privilege Escalation Vulnerability)
- CVE-2023-28229 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)