CISA’s required action for CVE-2022-38028 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Microsoft Windows in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.
What patching CVE-2022-38028 should look like in practice
For this print spooler privilege escalation issue, the first job is simple: confirm every Windows system that could still expose the vulnerability, then apply the vendor security update or the documented mitigation exactly as instructed. If you cannot apply either option, reduce exposure immediately and remove the affected product from service until you can. Track the estate, not just individual servers.
For vulnerability triage and emergency response, the right sequence is to treat exploited vulnerabilities as an emergency patching problem and then verify remediation at the asset level. Because the direct answer ties this CVE to in-the-wild exploitation, the operational question is not whether the flaw is theoretically serious, but whether any reachable Windows instance still has a viable attack path.
A useful operational habit is to separate “patched” from “not exploitable.” A machine can be updated and still remain risky if it is internet reachable, poorly segmented, or outside routine configuration control. That is why this kind of fix should be paired with asset inventory, exposure reduction, and a documented exception path for systems that cannot be taken out of service quickly.
How to reduce exposure when patching cannot happen immediately
If immediate patching is blocked, the goal is to narrow the attack surface rather than wait passively. Apply the documented vendor mitigation, disable or restrict the affected service path where possible, and remove unnecessary network exposure. If the system performs a business function that cannot tolerate downtime, isolate it from untrusted networks and place it under heightened monitoring until the fix lands.
That approach is consistent with the broader vulnerability-management discipline: prioritise by exploitation reality, not just severity labels. For a widely used Windows component, the practical decision is whether the system can still be reached in a way that makes privilege escalation useful to an attacker. If the answer is yes, exposure reduction is only a temporary control, not a substitute for remediation.
One common mistake is treating compensating controls as permanent. Network restrictions, segmentation, and service hardening reduce blast radius, but they do not remove the vulnerability itself. If the system is business critical, record the exception, define the expiry date, and assign ownership for revalidation after the patch window closes.
What to check after remediation and why it matters
Because this vulnerability was used in the wild, patching is only half the response. Review logs, endpoint detections, and administrative activity for evidence of earlier exploitation, especially on systems that were exposed before remediation. Look for unusual service behavior, unexpected privilege changes, suspicious child processes, and signs that an attacker used the spooler path to gain a higher-privilege foothold.
For attack-path thinking, map the post-exploitation chain to credential access and privilege escalation techniques so the hunt is not limited to a single binary indicator. A spooler bug can be only the entry point; the more important question is whether the attacker used it to establish persistence, move laterally, or stage follow-on access before the fix was applied.
If you find evidence of compromise, remediation needs to expand beyond the patch. Rebuild or reimage where appropriate, rotate credentials that may have been exposed on the affected host, and invalidate any sessions or access paths that could have been hijacked after escalation. The more privilege the compromised system had, the more likely the incident response scope must include adjacent assets.
Risk and Threat Considerations
This CVE matters because a local privilege escalation on Windows can turn a low-privilege foothold into administrative control, which is exactly the kind of condition attackers look for after initial access. When the flaw is actively exploited, the risk is not just service disruption, but privilege gain, lateral movement, and faster follow-on compromise.
Failure mechanism: An attacker with some level of access reaches a vulnerable Print Spooler path, escalates privileges, and then uses the newly elevated context to access data, install tooling, or persist on the host.
Impact: Successful exploitation can expand a small intrusion into broader system compromise, especially where the affected machine is connected to sensitive workloads or trusted management paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | CVE patching and exposure reduction are core continuous vulnerability management tasks. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Mitigation may require hardening or service restriction when patching is delayed. | |
| Recommendation — Prioritise, remediate and verify vulnerable Windows assets under your vulnerability management process. Harden or restrict exposed Windows systems until the vulnerability is fully remediated. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The question is about identifying, prioritising and fixing a known exploited vulnerability. |
| SI-2 — Flaw Remediation | Applying the vendor update or mitigation is direct flaw remediation for this CVE. | |
| Recommendation — Scan for affected Windows assets and track remediation until exposure is removed. Apply the vendor fix or documented mitigation and verify every affected host is remediated. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | This CVE is a Windows privilege escalation vulnerability used to gain higher privileges. |
| Recommendation — Hunt for privilege-escalation activity and review adjacent attacker actions after exposure. | ||
Practitioner Guidance
What to verify: Do not trust a generic patch statement. Verify that each relevant Windows instance is covered by the vendor update or the documented mitigation, and confirm that any system left unpatched has a documented exposure reduction in place.
What to prioritise: Start with internet-facing or operationally privileged Windows hosts, then move to systems that can affect authentication, administration, or shared services if compromised. Those are the hosts where privilege escalation has the highest blast radius.
Practitioner takeaway: For an exploited Windows privilege escalation, the correct response is remediation plus compromise review, not remediation alone, because the highest risk is often what happened before the patch was applied.
Related resources from NHI Mgmt Group
- CVE-2022-38028 (Microsoft Windows Print Spooler Privilege Escalation Vulnerability)
- How do you patch or mitigate CVE-2014-1812 (Microsoft Windows Group Policy Preferences Password Privilege Escalation)?
- How do you patch or mitigate CVE-2019-1388 (Microsoft Windows Certificate Dialog Privilege Escalation)?
- How do you patch or mitigate CVE-2024-38107 (Microsoft Windows Power Dependency Coordinator Privilege Escalation)?