Is CVE-2022-22718 (Microsoft Windows Print Spooler Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2022-22718 to its Known Exploited Vulnerabilities catalogue on 19 April 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation. Any organisation running the affected product should treat remediation as urgent.

What “in the wild” means for this CVE

For a CVE like this, “being exploited in the wild” means defenders have credible evidence that attackers are actively using the flaw against real systems, not just that the issue is theoretically exploitable or present in a lab proof-of-concept. CISA’s KEV listing is the practical signal to trust because it reflects confirmed exploitation, not speculation. For prioritisation, use the CISA Known Exploited Vulnerabilities Catalog alongside the vendor advisory and your own asset inventory.

When a Windows component is added to KEV, the relevant question is not whether exploitation is technically elegant, but whether any reachable, unremediated instance still exists in your environment. That is especially important for privilege-escalation flaws, because a single successful exploit can convert a low-privilege foothold into broader control. The fastest way to get the right context is to cross-check the CVE record in the CVE Program and the vulnerability details in NIST National Vulnerability Database.

Why Print Spooler privilege escalation is operationally urgent

Privilege-escalation flaws in a widely deployed Windows service deserve immediate attention because they can be used after initial access to raise attacker capabilities quickly, often before traditional detection catches up. If the vulnerable service is enabled on endpoints or servers that matter to the business, the issue is not limited to the local host, it can become a stepping stone to credential access, lateral movement, and persistence. That is why exploit confirmation changes prioritisation from normal patching to urgent remediation.

In practice, the urgency is driven by blast radius. A privilege-escalation bug in a core OS service may be reachable across many asset classes, including user workstations, remote access hosts, and administrative systems. If those systems are not inventoried cleanly, the organisation may underestimate exposure even when the patch itself is straightforward. For teams managing vulnerability response at scale, Vulnerability Management Guide is a useful companion for asset scoping, KEV triage, and remediation verification.

What to do if you cannot patch immediately

When remediation has to wait, the priority is to reduce exposure to the vulnerable service and narrow what an attacker could gain if exploitation occurs. For a Print Spooler issue, that usually means reviewing whether the service is actually required on the affected systems, then constraining exposure wherever the business can tolerate it. If the service must remain active, monitor for unusual privilege changes, new local admin activity, and suspicious post-exploitation behaviour on the host.

Do not treat temporary deferral as a benign exception unless you can justify the business need and document the compensating controls. The useful question is whether the delay still leaves a realistic exploit path open. Where privilege escalation is the concern, good interim controls are the ones that reduce attacker payoff, not just the ones that add paperwork. For broader defensive context on active exploitation, Zero-Day and Exploited Vulnerabilities Guide covers KEV triage, emergency mitigation, and post-patch hunting.

Risk and Threat Considerations

Active exploitation of a local privilege-escalation bug matters because it can turn a modest initial foothold into a system-level compromise. That often shortens the time between intrusion and meaningful impact, especially on unmanaged or slow-to-patch Windows fleets.

Failure mechanism: An attacker with limited code execution or local access abuses the Print Spooler vulnerability to raise privileges, then uses the higher trust level to disable controls, harvest data, or move laterally.

Impact: The result can be host takeover, faster lateral movement, and a larger incident scope than the original access would suggest.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation makes continuous vulnerability prioritisation central.
Recommendation — Prioritise and remediate the exploited CVE using continuous vulnerability tracking and verification.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The CVE requires prompt fix deployment and remediation tracking on affected Windows hosts.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation depends on identifying systems that remain vulnerable to the exploited flaw.
Recommendation — Apply flaw remediation controls to deploy the fix and track completion across all affected assets. Use vulnerability scanning to confirm which systems are still exposed and need urgent action.
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and recorded.	You must identify vulnerable Windows assets before you can prioritize this KEV item correctly.
	PR.IP-12 — A vulnerability management plan is developed and implemented.	Active exploitation makes a documented, repeatable vulnerability response process materially relevant.
Recommendation — Identify and record exposed assets so the exploited CVE can be prioritised and tracked. Use a vulnerability management process that escalates KEV-listed issues for urgent remediation.

Practitioner Guidance

What to prioritise: Verify which endpoints and servers actually have the Print Spooler enabled, then separate exposed business-critical systems from lab or low-value systems. If the service is unnecessary, removal or disablement is often the cleanest risk reduction; if it is required, treat the patch path as urgent rather than routine.

What to verify: Confirm that remediation really removed the exposure, not just that a change ticket was closed. For exploit-priority CVEs, validation should include service state, host coverage, and a quick hunt for any signs of post-exploitation activity on systems that were reachable before the fix.

Practitioner takeaway: For KEV-listed privilege-escalation flaws, the operational question is whether any exposed host can still be turned into a higher-privilege beachhead, because that determines both urgency and incident-response depth.