CVE-2022-21919 is an user profile service privilege escalation vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 April 2022, which means attackers have used it in real attacks. Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
Why this vulnerability matters
CVE-2022-21919 is a privilege escalation flaw in Microsoft Windows User Profile Service, which makes it valuable to attackers who already have some level of access and want to turn that foothold into higher privileges. For readers tracking the record itself, the authoritative sources are the CVE Program entry and the NIST National Vulnerability Database record.
The danger of privilege escalation is not just that a local bug exists, but that it can convert a limited user session into administrative reach. In Windows environments, that can change the outcome of an intrusion from a contained compromise to domain reconnaissance, credential access, lateral movement, or destructive action.
How exposure is usually assessed
Exposure starts with asset inventory: organisations need to know which Windows endpoints, servers, and virtual desktops are in scope, and which of them are internet-facing, user-accessible, or otherwise reachable by an attacker who can obtain a foothold. Patch and vulnerability teams should confirm whether the affected platform is present in their estate, then verify vendor guidance and the NVD record for authoritative remediation details.
Because CISA placed this CVE in the Known Exploited Vulnerabilities catalogue on 25 April 2022, exposure should be treated as operationally urgent rather than theoretical. For prioritisation, the most useful question is not whether a scanner flags the issue in the abstract, but whether the vulnerable Windows service is reachable on systems that matter to business operations.
Remediation and compensating controls
The preferred response is to apply the vendor fix and remove the exposure from every affected system. Where patching must be delayed, reduce the blast radius by restricting interactive access to exposed hosts, limiting local admin membership, hardening remote access paths, and watching for unusual privilege changes around Windows profile management.
For prioritisation, use a vulnerability management process that combines asset scope, exploitability, and exposure context. NHIMG’s Vulnerability Management Guide is a useful companion for turning KEV-listed findings into remediation queues, exception handling, and verification.
Detection and post-exploitation review
Privilege escalation rarely stays isolated. After exploitation, defenders should review authentication events, new administrative group membership, unusual service activity, and suspicious use of profile-related binaries or scripts on the affected machine. The point is to determine whether the exploit was only attempted, or whether it was followed by persistence, credential theft, or movement to other systems.
MITRE ATT&CK Enterprise Matrix is the best external reference for mapping the likely follow-on behaviour after local privilege escalation, especially when you need to connect one Windows host compromise to broader adversary tradecraft.
Risk and Threat Considerations
Privilege escalation vulnerabilities are especially dangerous because they often sit at the transition point between initial access and full compromise. If an attacker can land on a Windows system as a standard user and then elevate through the User Profile Service, the vulnerability can become a reliable stepping stone into broader host control and downstream identity abuse.
Failure mechanism: A local attacker abuses the flaw to elevate privileges, then uses that elevated context to disable controls, access protected files, or prepare further movement through the environment.
Impact: The compromise can expand from one user session to system-level control, increasing the likelihood of data access, persistence, lateral movement, and incident containment failure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Windows privilege escalation flaws require timely remediation and verification. |
| AC-6 — Least Privilege | Privilege escalation succeeds when local permissions exceed the minimum needed. | |
| Recommendation — Track, prioritize, and remediate this CVE as a flaw-remediation item. Reduce local privileges to limit escalation opportunities. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | This CVE is a privilege escalation condition consistent with ATT&CK escalation tradecraft. |
| Recommendation — Map detections and hunting to exploitation-for-privilege-escalation behavior. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | KEV-listed exploitation should feed risk prioritization and remediation strategy. |
| Recommendation — Prioritize KEV-listed exposure in your risk management workflow. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This is a vulnerability management and remediation use case for exposed Windows assets. |
| Recommendation — Continuously identify and remediate vulnerable Windows systems. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed privilege escalation issues as more than patch hygiene. They are often the difference between a noisy endpoint event and a materially serious compromise, so remediation priority should reflect both reachability and the value of the affected host.
What to watch for: Monitor for privilege transitions, unexpected admin-level processes, and repeated failed or unusual access around profile-related activity. If the system is important enough to host sensitive work, assume an attacker will try to chain the bug with credential theft or remote execution.
Related resources from NHI Mgmt Group
- CVE-2022-41125 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
- CVE-2022-41033 (Microsoft Windows COM+ Event System Service Privilege Escalation)
- CVE-2022-38028 (Microsoft Windows Print Spooler Privilege Escalation Vulnerability)
- CVE-2023-28229 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org