How do you patch or mitigate CVE-2022-26904 (Microsoft Windows User Profile Service Privilege Escalation)?

CISA’s required action for CVE-2022-26904 is to apply updates per vendor instructions. In practice, find every instance of Microsoft Windows in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What CVE-2022-26904 changes in a Windows patching workflow

The practical issue with this vulnerability is not just whether a patch exists, but whether every Windows instance is known, reachable, and still supported in a way that lets you apply it cleanly. For a privilege-escalation CVE, the real control objective is to close the elevation path everywhere, then verify no exposed host remained a stepping stone before the fix landed.

Because the direct answer already points to vendor updates and fallback mitigation, the first step is to treat this as an estate-wide remediation problem, not a single-server patch task. That means inventorying affected Windows systems, confirming who owns each one, and separating systems that can be updated immediately from those that need temporary containment.

For broader guidance on prioritising exploited flaws, see the Zero-Day and Exploited Vulnerabilities Guide.

How to reduce exposure if patching is delayed

If you cannot apply the vendor update right away, the mitigation priority is to remove the vulnerable system from high-risk exposure paths rather than hoping it stays unexploited. That usually means shrinking internet-facing access, constraining administrative reach, and taking the product out of service where the business impact is tolerable.

For a privilege-escalation flaw, delayed patching is especially dangerous when the affected host already sits near credentials, admin tooling, or other systems an attacker would value after gaining a foothold. The security decision is therefore about blast radius, not convenience: if the host cannot be fixed promptly, it should be harder to reach and less useful if compromised.

When patching is blocked by operational constraints, the best next move is usually to document the exception, enforce compensating controls, and set a short deadline for either remediation or shutdown. Temporary exposure is only defensible when you can show that the affected instance is contained and that the residual risk is understood.

What to check after remediation

Patch completion is not the end of the work. Because the flaw was actively exploited in the wild, teams should review authentication, privilege, and system logs for signs that the host was abused before the update was applied. That includes unusual account use, privilege changes, suspicious service activity, and lateral movement from the affected machine.

If you find evidence of pre-patch compromise, treat the event as an incident, not a hygiene issue. Rebuild or isolate the system as needed, then review adjacent accounts, sessions, and management paths that may have been exposed through the vulnerable host.

For post-remediation hunting and compromise assessment, use the post-patch hunting guidance in the same guide and compare findings against your vulnerability management process. The remediation is only complete when you have both applied the fix and checked for evidence of earlier abuse.

Risk and Threat Considerations

This CVE matters because privilege escalation changes the attacker’s position after initial access. A flaw like this can let an intruder move from a low-value foothold to elevated control on the same Windows system, which then increases the chance of credential access, persistence, and lateral movement.

Failure mechanism: The attacker first obtains some level of access, then uses the local escalation weakness to become more privileged on the host, often with better visibility and broader system control.

Impact: Once elevation succeeds, the compromised Windows system can become a launch point for deeper intrusion, making containment harder and expanding the set of accounts, data, and connected systems at risk.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This CVE requires rapid identification and remediation of vulnerable Windows assets.
Recommendation — Scan, prioritise, and remediate exposed Windows systems before attackers can reuse the flaw.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about patching a known vulnerability per vendor guidance.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation and post-fix verification depend on finding affected hosts.
Recommendation — Apply vendor updates or mitigations and track remediation to closure. Continuously identify affected hosts and verify remediation across the estate.
MITRE ATT&CK	T1068 — Exploitation for Privilege Escalation	The CVE is a privilege-escalation vulnerability and should be hunted as such.
	T1021 — Remote Services	Temporary mitigation often involves reducing reachable attack surface on exposed hosts.
Recommendation — Map detections to privilege-escalation behavior and investigate suspicious elevation paths. Restrict remote access paths that let attackers reach vulnerable Windows systems.

Practitioner Guidance

What to prioritise: Patch all Windows instances with the shortest exposure window first, especially systems that are internet-facing, remotely administered, or close to privileged accounts. If you must stage the rollout, begin with the hosts most likely to turn a local escalation into a broader incident.

What to verify: Confirm that the vendor update or documented mitigation was actually applied to every in-scope endpoint, not just the obvious servers. Then validate that exposed systems are no longer reachable in the ways that made the vulnerability operationally dangerous.

Practitioner takeaway: For an exploited privilege-escalation CVE, remediation is only credible when patching, exposure reduction, and compromise hunting are treated as one response sequence.