Is CVE-2022-21999 (Microsoft Windows Print Spooler Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2022-21999 to its Known Exploited Vulnerabilities catalogue on 25 March 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation. Any organisation running the affected product should treat remediation as urgent.

What this means for exploitation status

CISA’s KEV listing is the key signal here because it reflects confirmed active exploitation, not just theoretical weakness. For CVE-2022-21999, the practical question is therefore not whether the flaw exists, but whether your Windows print infrastructure is still exposed to a privilege-escalation path that attackers are already using. Treat the KEV entry as a trigger for immediate triage, not a general advisory.

For vulnerability response, the most useful first step is to verify whether any Windows systems in scope still run the vulnerable print spooler component and whether those systems are reachable by untrusted users or remote management paths. The CISA Known Exploited Vulnerabilities Catalog and the vendor advisory should be the authoritative sources for exact remediation details and any compensating controls.

Where a privilege-escalation flaw is already being exploited in the wild, exposure is often broader than the initial endpoint itself because attacker use of the weakness can lead to higher-privilege access, service manipulation, or follow-on credential abuse. The operational question is whether the affected hosts can be used as a foothold into admin-level control, not simply whether the service is installed.

Why print spooler exploitation is operationally serious

Privilege-escalation issues in print-related services matter because they can turn a low-privilege foothold into elevated access on the same host. In an enterprise, that can be enough to disable protections, tamper with logs, stage additional tooling, or pivot toward adjacent systems if the compromised endpoint has trust relationships or local administrative context.

That is why confirmed exploitation of a Windows print spooler flaw should be handled as a live intrusion-risk indicator, especially on servers, jump hosts, and endpoints with broad administrative reach. If the vulnerable component is present on systems that also store credentials, broker sessions, or support administrative work, the blast radius can expand quickly even when the original flaw is only a local privilege escalation.

For vulnerability triage, the most relevant reference point is a complete exploited-vulnerability process, not just patch deployment. The Zero-Day and Exploited Vulnerabilities Guide is useful here because it frames KEV-driven response, emergency mitigation, and post-remediation hunting as one workflow rather than separate tasks.

What to do when patching or mitigation cannot happen immediately

If remediation is delayed, reduce exposure by narrowing where the print spooler can run, limiting who can reach the affected systems, and watching for unusual privilege changes, service tampering, or process creation consistent with post-exploitation activity. If the host is business-critical, the temporary objective is to make exploitation harder and more visible while the permanent fix is queued.

Do not rely on “we have not seen alerts” as evidence of safety. Active exploitation often shows up first as abnormal privilege boundaries, not as a clean signature, so compensating controls should focus on containment, segmentation, and rapid detection of privilege escalation side effects.

Use the Vulnerability Management Guide to align triage with asset scope, remediation priority, verification, and exception handling so the response is driven by exposure and exploitability, not by backlog order.

Risk and Threat Considerations

Once a print spooler flaw is confirmed in the wild, the main risk is not the printer service itself but the privilege boundary it can collapse. A successful exploit can convert a routine workstation or server into a higher-privilege launch point, which is especially dangerous when the host already has administrative access, privileged sessions, or access to sensitive internal services.

Failure mechanism: An attacker abuses the privilege-escalation condition to move from a lower-privilege context to a more powerful local context, then uses that position to disable controls, access sensitive data, or establish persistence.

Impact: The result can be host compromise with broader lateral-movement potential, faster follow-on credential abuse, and materially higher incident response cost if the affected system is trusted by other parts of the environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require prioritized vulnerability handling and verification.
Recommendation — Prioritise and verify remediation for the KEV-listed flaw on exposed Windows assets.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The question is about an actively exploited vulnerability and response urgency.
	SI-2 — Flaw Remediation	Active exploitation makes timely remediation and mitigation the core control response.
Recommendation — Scan for affected hosts and track remediation until exposure is removed. Apply the vendor fix or mitigation as soon as operationally possible.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	KEV-driven triage is a risk-prioritisation decision, not just a patch task.
	PR.PS-01 — Configuration Management	Reducing exposed print-spooler attack surface depends on secure configuration and hardening.
Recommendation — Treat KEV-listed exploitation as a high-priority risk input in remediation decisions. Remove or harden unnecessary print-spooler exposure on critical Windows systems.

Practitioner Guidance

What to prioritise: Prioritise systems where print services exist on administrative workstations, servers with broad trust, or assets that already hold privileged sessions or cached secrets. Those systems create the largest practical blast radius if the privilege escalation is abused.

What to verify: Confirm exposure at the asset level, not just the product level. You want to know which hosts are reachable, whether print spooler functionality is actually needed, and whether any of the exposed systems can be used as an entry point into administrative control.

Decision rule: If the vulnerable component is present on a system that can influence other systems or hold privileged access, treat remediation as urgent and investigate for pre-remediation compromise in parallel rather than sequentially.

Practitioner takeaway: For KEV-listed privilege-escalation bugs, the correct response is to assume exploitation is plausible until you have both remediated exposure and checked for signs that the weakness was already used.