Yes. CISA added CVE-2022-41073 to its Known Exploited Vulnerabilities catalogue on 8 November 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. Any organisation running the affected product should treat remediation as urgent.
Why this is an exploited vulnerability question, not just a version check
The practical question is whether defenders should treat CVE-2022-41073 as an active exposure. For this kind of issue, the key decision is not abstract severity, it is whether the vulnerable Windows Print Spooler service is present, reachable, and able to be abused to gain SYSTEM-level privileges. A confirmed KEV listing means the issue belongs in urgent remediation and verification workflows, not routine backlog triage.
That is why the first step is to confirm whether any Windows systems still expose Print Spooler where they do not need it, especially on servers and high-value endpoints. If the service must remain enabled, its placement and management matter because privilege-escalation flaws are often chained with other access paths to turn limited access into full control.
What “being exploited in the wild” means for response
CISA’s KEV catalogue is the most operationally useful signal here because it reflects reliable evidence of active exploitation, not just a theoretical weakness. When a vulnerability is catalogued there, the working assumption should be that attackers have already found a way to use it, so patching, mitigations, and exposure reduction need to happen quickly and in parallel rather than sequentially.
For a Print Spooler privilege-escalation flaw, the response goal is to remove the attacker’s easiest route to SYSTEM privileges on any system that still permits spooler abuse. If you cannot remediate immediately, the minimum acceptable posture is to reduce exposure, limit where the service runs, and watch for signs that local privilege escalation has already occurred.
What to validate before you declare the issue contained
Containment is not just “we installed a fix.” You also need to validate whether the vulnerable hosts were ever accessible to an attacker, whether the service was enabled where it should not have been, and whether privilege escalation was followed by persistence or lateral movement. That matters because exploitability plus SYSTEM-level impact can turn one local foothold into broader domain or endpoint compromise.
If the affected machine handled administrative work, security tooling, or service accounts, the blast radius is larger. In that case, review whether any credentials, sessions, scheduled tasks, or service contexts were exposed after exploitation, because a local privilege escalation event can be the start of a wider incident rather than the end of one.
Risk and Threat Considerations
Privilege-escalation flaws in core Windows components are attractive because they are often used after an initial foothold to convert low-privilege access into full system control. In an exploited-in-the-wild case, the main risk is not only the vulnerability itself, but the speed with which an attacker can use SYSTEM privileges to disable defenses, dump credentials, deploy payloads, or move laterally.
Failure mechanism: An attacker with any usable foothold on an exposed host can abuse the Print Spooler flaw to escalate privileges to SYSTEM, then use that control to persist, tamper with security tooling, or stage additional movement inside the environment.
Impact: The result can include endpoint takeover, credential exposure, ransomware staging, and loss of trust in the affected host and adjacent systems, which is why CISA’s KEV catalogue is used as an urgent prioritisation signal.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and documented | Active exploitation makes vulnerability identification and exposure tracking central to this CVE response. |
| PR.AA-05 — Access permissions and authorizations are managed | SYSTEM-level escalation requires least-privilege and authorization limits on affected hosts. | |
| DE.CM-07 — Monitoring for unauthorized personnel, connections, devices, and software is performed | Exploitation can leave host-level compromise signs that monitoring should surface. | |
| Recommendation — Identify exposed Print Spooler hosts and document where the vulnerability exists. Restrict who can administer affected systems and remove unnecessary privilege. Monitor for suspicious privilege changes and spooler-related abnormal activity. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE requires urgent remediation once active exploitation is known. |
| SI-4 — System Monitoring | Post-exploitation detection depends on monitoring for signs of SYSTEM-level abuse. | |
| Recommendation — Patch or mitigate the vulnerable Print Spooler exposure immediately. Alert on suspicious spooler activity, privilege escalation, and persistence signals. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The vulnerability’s abuse path is privilege escalation to SYSTEM-level access. |
| Recommendation — Map host telemetry to privilege-escalation activity and investigate exploitation chains. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation requires rapid identification and remediation of exposed systems. |
| CIS-8 — Audit Log Management | Compromise validation depends on reliable logs around escalation and follow-on activity. | |
| Recommendation — Prioritise and remediate the vulnerable hosts using KEV-based triage. Preserve and review logs for signs of privilege escalation and post-exploit actions. | ||
Practitioner Guidance
What to prioritise: Treat any internet-facing, high-value, or privileged Windows system with the Print Spooler enabled as immediate remediation scope. If the service is not required, disable it; if it is required, move it into a tightly controlled exception path and verify that remediation is tracked to closure.
What to verify: Confirm whether the host has already shown post-exploitation indicators, including unexpected new local admins, suspicious service changes, unusual child processes from spool-related activity, or security tooling gaps. If you find signs of compromise, rotate affected local and domain credentials as needed and broaden the hunt before you assume patching alone is sufficient.
Practitioner takeaway: For a KEV-listed privilege-escalation bug, the right question is not whether exploitation is possible, but whether the attacker may already have used it to gain a stronger foothold than your initial access logs reveal.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- Is CVE-2022-22718 (Microsoft Windows Print Spooler Privilege Escalation) being exploited in the wild?
- Is CVE-2022-21999 (Microsoft Windows Print Spooler Privilege Escalation) being exploited in the wild?
- Is CVE-2022-38028 (Microsoft Windows Print Spooler Privilege Escalation Vulnerability) being exploited in the wild?
- How do you patch or mitigate CVE-2022-41073 (Microsoft Windows Print Spooler Privilege Escalation)?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org