CVE-2022-21999
📋 TL;DR
This vulnerability allows attackers to gain SYSTEM-level privileges on Windows systems by exploiting the Print Spooler service. It affects Windows servers and workstations where the Print Spooler service is running. Attackers can execute arbitrary code with elevated privileges once they have initial access to the system.
💻 Affected Systems
- Windows Server
- Windows Client
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1909 by Microsoft
Windows 10 20h2 by Microsoft
Windows 10 21h1 by Microsoft
Windows 10 21h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of persistent malware, credential theft, lateral movement, and data exfiltration.
Likely Case
Privilege escalation from a lower-privileged user account to SYSTEM, allowing attackers to bypass security controls and maintain persistence.
If Mitigated
Limited impact if Print Spooler service is disabled or proper network segmentation prevents initial access.
🎯 Exploit Status
Exploitation requires initial access to the system. CISA has added this to its Known Exploited Vulnerabilities catalog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: January 2022 security updates (KB5009543 for Windows 10, KB5009557 for Windows 11, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999
Restart Required: Yes
Instructions:
1. Apply January 2022 Windows security updates from Microsoft Update. 2. Restart affected systems. 3. Verify patch installation via Windows Update history.
🔧 Temporary Workarounds
Disable Print Spooler Service
windowsStops the vulnerable service from running
sc stop spooler
sc config spooler start= disabled
Restrict Spooler Directory Permissions
windowsLimits access to spooler directories
icacls %systemroot%\system32\spool\PRINTERS /deny "Authenticated Users":(OI)(CI)F
🧯 If You Can't Patch
- Disable Print Spooler service on all non-print servers
- Implement network segmentation to restrict RPC access to print servers
🔍 How to Verify
Check if Vulnerable:
Check if Print Spooler service is running and system lacks January 2022 security updatesCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update shows January 2022 security updates installed and system version is patched📡 Detection & Monitoring
Log Indicators:
- Event ID 7036 for Print Spooler service stopping/starting
- Suspicious RPC calls to spoolsv.exe
Network Indicators:
- Unusual RPC traffic to port 135/445 from non-print clients
SIEM Query:
EventID=7036 AND ServiceName="Spooler" AND (State="running" OR State="stopped")