Yes. CISA added CVE-2022-26904 to its Known Exploited Vulnerabilities catalogue on 25 April 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. Any organisation running the affected product should treat remediation as urgent.
What it means when a CVE appears in CISA’s KEV catalogue
For a vulnerability question, the most practical signal is whether a trusted operational source has moved it from “possible” exploitation to “confirmed active exploitation.” CISA’s KEV catalogue is specifically used to flag vulnerabilities that need urgent attention because exploitation is already happening in the wild. That changes prioritisation, even before you know whether your own estate has been touched.
When a CVE enters KEV, the question is no longer only “is there a fix?” It becomes “are we exposed, how fast can we remove the exposure, and what evidence do we need to decide whether compromise already occurred?” For a Windows privilege-escalation issue, that means treating identity boundaries, local admin pathways, and vulnerable endpoints as urgent review items.
For a broader response pattern, NHI Management Group’s Zero-Day and Exploited Vulnerabilities Guide is useful because it ties KEV-style triage to emergency mitigation, compromise assessment, and post-patch hunting. The key point is that “actively exploited” should trigger operational response, not just ticketing.
How to confirm whether you are exposed to CVE-2022-26904
Start by identifying every Windows system that could host the affected User Profile Service component, including laptops, servers, jump hosts, and any environment where users can log on interactively. Exposure review should not stop at the patching team’s inventory; systems that are domain-joined, remotely managed, or used for privileged work deserve priority because privilege escalation on those hosts has a bigger blast radius.
Then verify whether your environment has compensating controls that would have limited abuse, such as restricted local administrator membership, constrained service accounts, hardened remote administration, and rapid detection for unusual privilege changes. If a host can be reached by standard users and still allows sensitive local actions, the practical exposure is greater than the raw presence of the CVE suggests.
Use CISA’s Known Exploited Vulnerabilities Catalog as the operational reference point for urgency, and pair it with the vendor advisory for exact version and remediation details. The catalogue tells you why the issue is being escalated; the vendor documentation tells you what to change on your systems.
What to do if patching has to wait
If remediation cannot happen immediately, reduce the opportunity for privilege escalation rather than assuming monitoring alone will save you. That usually means tightening local privilege, limiting interactive logons on the most exposed systems, isolating high-value hosts, and watching for anomalous account elevation or suspicious use of profile-related system activity.
Because this flaw is about privilege escalation, the main short-term objective is blast-radius reduction. A system that must remain online should be treated as temporarily higher risk until it is fixed, especially if it hosts privileged users, administrative tooling, or shared access points.
In practice, Privileged Access Management Guide is the most relevant internal reference for the containment side of this problem, because it focuses on reducing standing privilege and constraining elevated access. If you are forced to defer patching, that is where your compensating control effort should be concentrated.
Risk and Threat Considerations
This CVE matters because active exploitation turns a local Windows weakness into a likely initial foothold or escalation step. Once an attacker can elevate privileges on a host, the next move is often credential access, lateral movement, persistence, or tampering with security tooling.
Failure mechanism: A privilege-escalation bug lets a lower-privileged user gain stronger rights on the same system, which can break the trust boundary around that host and expose administrative data or actions.
Impact: The practical consequence is that an otherwise ordinary Windows endpoint can become a launch point for broader compromise, especially if it is used for administration, contains cached credentials, or can reach sensitive internal resources.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Hardening Windows hosts reduces exploitability of active privilege-escalation flaws. |
| Recommendation — Harden Windows assets and reduce exposed paths that could enable privilege escalation. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | A KEV-listed Windows flaw requires rapid identification, prioritization, and remediation. |
| AC-6 — Least Privilege | Privilege-escalation exploits are blunted by limiting unnecessary local and administrative rights. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on detecting abnormal privilege and account activity. | |
| Recommendation — Prioritise and remediate the vulnerable Windows systems without delay. Restrict privileges so a local user cannot easily escalate to administrative access. Review audit records for signs of privilege escalation or suspicious account activity. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerabilities Are Identified and Documented | You need to know which Windows assets are exposed before you can prioritize response. |
| PR.PS-01 — Configuration Management | Configuration hardening and baseline control help limit exploitation paths on Windows hosts. | |
| Recommendation — Identify and document the exposed Windows assets that may be affected. Apply secure configuration baselines to reduce the attack surface on affected hosts. | ||
Practitioner Guidance
What to verify: Confirm whether any Windows systems in your estate are still unpatched, and prioritise the ones used by privileged users or administration teams. On those hosts, check for evidence of unusual logons, sudden privilege changes, and unexpected account activity around the exposure window.
Decision rule: If the affected host cannot be remediated immediately, treat it as an elevated-risk asset and narrow access first, then investigate whether any credentials, sessions, or administrative workflows on that host may already have been exposed.
What good looks like: The vulnerable systems are identified, patched or otherwise mitigated quickly, and there is a clear record of whether any suspicious privilege activity was present before remediation.
Practitioner takeaway: For a KEV-listed privilege-escalation CVE, urgency is driven by exploit evidence, not by waiting for confirmed impact in your own environment.
Related resources from NHI Mgmt Group
- CVE-2022-26904 (Microsoft Windows User Profile Service Privilege Escalation)
- Is CVE-2022-41125 (Microsoft Windows CNG Key Isolation Service Privilege Escalation) being exploited in the wild?
- Is CVE-2022-41033 (Microsoft Windows COM+ Event System Service Privilege Escalation) being exploited in the wild?
- CVE-2022-21919 (Microsoft Windows User Profile Service Privilege Escalation)