Is CVE-2022-22047 (Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2022-22047 to its Known Exploited Vulnerabilities catalogue on 12 July 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges. Any organisation running the affected product should treat remediation as urgent.

What it means for a Windows CSRSS flaw to be actively exploited

CISA’s KEV listing is the practical signal that matters most here. For defenders, it means the issue has moved beyond theoretical exposure and should be treated as an active threat condition, not a routine patch-cycle item. The right response is to confirm whether any Windows systems still expose the vulnerable CSRSS component, then prioritise containment and remediation before broader maintenance work.

For triage, the key question is not whether the organisation “has a patch window”, but whether the vulnerable product is reachable on a business-critical host and whether that host can be recovered quickly if compromise is suspected. A KEV-listed privilege escalation issue can turn a low-privilege foothold into SYSTEM-level control, which changes the incident response posture immediately.

When you need a practical playbook for that sort of response, the Zero-Day and Exploited Vulnerabilities Guide is the most directly relevant starting point because it focuses on KEV-driven prioritisation, emergency mitigation and post-patch hunting.

Why privilege-escalation exploitation changes the risk picture

Privilege escalation is dangerous because it can collapse the normal separation between a user session and full host control. Once an attacker can reach SYSTEM privileges, they may be able to disable protections, tamper with security tooling, steal additional credentials, or stage further movement from the affected endpoint. That is why exploited local escalation flaws often matter even when initial access seems limited.

The impact also depends on where the vulnerable system sits in the environment. A workstation issue is serious, but a flaw on a jump host, server, or administrative system has a larger blast radius because it can expose higher-value secrets and sessions. If the vulnerable machine also hosts admin tooling, the compromise can become a stepping stone to broader identity or infrastructure takeover.

For a broader view of how adversaries chain exploitation into credential access and lateral movement, the MITRE ATT&CK Enterprise Matrix is useful for mapping the downstream techniques that often follow privilege escalation.

How to respond when patching must wait

If remediation cannot happen immediately, treat the host as exposed and reduce the attacker’s room to move. That usually means limiting interactive access, increasing monitoring around the affected system, and avoiding unnecessary exposure of the host to privileged users until the fix is in place. For a privilege-escalation issue, delaying action is only reasonable when the system is clearly isolated and the business owner accepts the residual risk.

You should also review whether the machine has already shown signs of suspicious privilege changes, unexpected service creation, anomalous logon activity, or tampering with endpoint security controls. Those checks matter because active exploitation often leaves little time between initial access and SYSTEM-level abuse. If evidence of compromise exists, the issue is no longer just patch management, it becomes incident response.

When a team needs a concrete prioritisation model for this kind of exposure, CISA Known Exploited Vulnerabilities Catalog should be the first external reference, and NIST National Vulnerability Database helps with the record-level vulnerability context.

Risk and Threat Considerations

Active exploitation changes this from a code-quality issue into an exposure issue. The main risk is that an attacker who already has some foothold can convert limited access into full local control, often before defenders notice the initial entry path.

Failure mechanism: A local privilege-escalation flaw lets the attacker break out of a restricted context and gain SYSTEM privileges, which can bypass local protections and enable credential theft, persistence, or further movement.

Impact: The affected host may become a launch point for broader compromise, and any secrets, sessions, or security tooling present on that machine may be exposed or manipulated.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	Privilege escalation is the core attacker path in this KEV-listed Windows flaw.
Recommendation — Map local escalation paths to T1068 and hunt for follow-on credential theft or lateral movement.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	KEV triage depends on identifying whether vulnerable Windows assets exist in scope.
	PR.IP-12 — Vulnerability Management	The question is about active exploitation and urgent remediation of a known vulnerability.
Recommendation — Identify exposed Windows assets and tag KEV-listed flaws for urgent remediation. Prioritise remediation of exploited vulnerabilities ahead of routine patch queues.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation calls for fast identification, prioritisation and remediation of vulnerabilities.
Recommendation — Continuously inventory, prioritise and remediate exploited vulnerabilities first.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This answer hinges on urgent remediation of a known exploited software flaw.
Recommendation — Remediate the vulnerable component promptly and verify the fix is deployed.

Practitioner Guidance

What to prioritise: Put KEV-listed privilege-escalation flaws ahead of normal backlog work, especially on systems that can reach sensitive credentials, admin tooling, or other privileged resources.

What to verify: Confirm whether vulnerable Windows hosts are still present, whether they are business critical, and whether there are any signs of suspicious local privilege elevation or post-exploitation activity.

Decision rule: If the system is externally reachable, privileged, or hard to rebuild quickly, treat exposure as urgent and move to containment and remediation before broader operational work.

Practitioner takeaway: For exploited local privilege-escalation issues, the main decision is not whether the flaw is real, it is whether you can still trust the host enough to wait.