Is CVE-2022-41125 (Microsoft Windows CNG Key Isolation Service Privilege Escalation) being exploited in the wild?

What “being exploited in the wild” means for this CVE

For this advisory, the practical question is not whether the flaw is interesting, but whether defenders should treat it as active attack surface. CISA’s KEV inclusion is the key signal that this is not just a theoretical Windows privilege escalation. The immediate task is to confirm whether any Windows CNG Key Isolation Service exposure remains in your environment and whether affected systems are already being targeted through it.

The safest operational assumption is that exploitability matters more than elegance here. Even when the vulnerability details are sparse, a SYSTEM-level privilege escalation inside a core Windows service can become a stepping stone to endpoint takeover, credential access, and persistence if attackers already have a foothold.

How to triage exposure without overcomplicating the response

Start with asset scope, then move to exposure validation, and only then to remediation timing. Systems running the vulnerable Microsoft Windows component should be treated as higher priority if they are internet-facing, broadly reachable internally, or already show signs of suspicious administrative activity. The CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm the KEV status and align your response window.

If you need a structured response path, the Zero-Day and Exploited Vulnerabilities Guide is the most direct internal reference for triaging actively exploited flaws, prioritizing emergency mitigation, and deciding when to move from routine patching to incident-style handling.

When patching is delayed, reduce the likely blast radius rather than waiting for perfect certainty. That means tightening administrative exposure on the affected hosts, reviewing who can log on locally or remotely, and watching for privilege changes or suspicious service activity around the CNG Key Isolation component.

What to check for compromise, and when to assume abuse

Because the reported impact is SYSTEM-level privilege gain, defenders should look for follow-on behavior that matches elevated attacker execution rather than only the initial exploit. Review endpoint telemetry for unusual service creation, privilege changes, defensive tool tampering, suspicious child processes from privileged services, and evidence that an attacker used the host to move laterally or stage additional tooling.

The Persistence Techniques Guide helps frame the post-exploitation question correctly, because privilege escalation is often followed by service-based persistence, scheduled tasks, or registry-based autostart mechanisms.

Where you need a broader detection lens for what attackers do after privilege escalation, MITRE ATT&CK Enterprise Matrix is a useful external reference for mapping credential access, privilege escalation, persistence, and lateral movement behaviors into your hunt plan.

Practitioner Guidance

What to prioritise: Treat any unpatched or unverified Windows fleet as priority exposure first, then decide whether the systems are merely vulnerable or already operationally risky because of their role, privilege level, or network reach. If the host can support administrative actions, assume the impact of compromise is materially higher.

What to verify: Confirm the exact Windows build and service exposure from your own inventory, then validate whether the host has shown signs of privilege escalation or post-exploit activity. The important evidence is not only patch state, but whether the endpoint has already behaved like a foothold.

Decision rule: If patching cannot happen immediately, compensate by shrinking access paths and intensifying monitoring on the affected systems. If you detect any administrative anomaly, treat the case as a potential compromise investigation rather than a routine vulnerability ticket.

Practitioner takeaway: For KEV-listed privilege escalations, the right question is not “can this be exploited?” but “what trusted actions could an attacker perform after exploitation, and have we already seen those signs?”

Related resources from NHI Mgmt Group

• Is CVE-2023-28229 (Microsoft Windows CNG Key Isolation Service Privilege Escalation) being exploited in the wild?
• CVE-2022-41125 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
• CVE-2023-28229 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
• Is CVE-2014-1812 (Microsoft Windows Group Policy Preferences Password Privilege Escalation) being exploited in the wild?