CVE-2022-21919: Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Overview

CVE-2022-21919 is a privilege escalation vulnerability in the Microsoft Windows User Profile Service. An attacker who already has a foothold on a system could abuse it to gain higher privileges. Privilege escalation flaws matter because they turn limited access into full control of the host, enabling further lateral movement, persistence, or data access. Public detail on the exact root cause is limited; treat the CISA description and the vendor advisory as the authoritative sources.

CISA characterizes the issue as an unspecified vulnerability in the User Profile Service that allows privilege escalation. Known ransomware use is not documented. The required action is to apply updates per vendor instructions.

How it works

The weakness is tracked as CWE-1386 and affects the Windows User Profile Service, the component that loads and manages user profiles during logon and session activity. Privilege-escalation bugs in this class typically arise when the service mishandles profile paths, junctions, or related objects in a way that lets a lower-privileged process influence higher-privileged operations.

An attacker who can already run code as a standard user would attempt to trigger the vulnerable behavior so that the service performs an action with elevated rights on the attacker’s behalf. Exact exploit mechanics are not provided in the public summary; do not assume specific techniques. Confirm any technical details against the Microsoft advisory for this CVE.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows systems that include the User Profile Service—essentially the majority of client and server installations that support interactive or remote user sessions. Inventory every Windows endpoint and server in your environment.

• Use your asset-management or configuration-management database, Microsoft Endpoint Configuration Manager, Intune, or equivalent tools to list Windows builds and patch levels.
• Confirm whether the User Profile Service (ProfSvc) is present and running; it is a standard component on supported Windows releases.
• Compare installed updates against the Microsoft security update that addresses CVE-2022-21919. Specific version ranges are not listed here—verify them directly in the vendor advisory.
• Review authentication and process-creation logs (Security event logs, Sysmon, EDR telemetry) for unusual activity around profile load/unload, unexpected elevation of user-mode processes, or anomalous access to profile directories. These signs are generic for privilege-escalation attempts and are not unique indicators of this CVE.

If you cannot map a host to a patched build, treat it as potentially affected until confirmed otherwise.

How to remediate

Patch first. Apply the Microsoft security update that remediates CVE-2022-21919 according to the vendor’s instructions and your normal change process. Prioritize domain-joined workstations, jump hosts, and servers that allow interactive or RDP logons, because those systems are the most common targets for local privilege escalation.

• Deploy the update through WSUS, Microsoft Update, Intune, or your enterprise patch pipeline.
• Verify installation with compliance reports or by checking the update history / build number on sample hosts.
• After patching, reboot if required by the update so the User Profile Service loads the corrected code.
• As general hardening for this class of issue, enforce least privilege, restrict who can log on locally or via RDP, and keep endpoint detection and response (EDR) agents current so they can flag suspicious profile-service or elevation activity.

If you can't patch immediately

When immediate patching is not possible, reduce the attack surface and increase detection until the update can be applied.

• Segment high-value systems and limit interactive logon rights so that only necessary accounts can reach the User Profile Service context.
• Use application control or WDAC/AppLocker policies to restrict untrusted binaries that could be used as a local foothold.
• Enable and forward detailed process-creation, logon, and object-access events; alert on unexpected elevation or unusual access to user-profile paths.
• If your EDR or host firewall supports virtual patching or behavioral blocks for privilege-escalation patterns, enable those protections while confirming they do not break legitimate profile operations.
• Disable or restrict any non-essential features that broaden local attack surface only if your environment can tolerate the change; do not disable core profile services without testing.

These steps are compensating controls only. They do not replace the vendor update.

If your data may have been exposed

Actively exploited privilege-escalation vulnerabilities frequently appear in breach chains once an attacker has initial access. If you have evidence of exploitation or unpatched systems that were reachable by untrusted users, follow your incident-response process: isolate affected hosts, preserve volatile evidence, and hunt for persistence and lateral movement. Known ransomware use of this specific CVE is not documented, but that does not rule out other post-exploitation activity.

As a quick external check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or personal information have already appeared in public dumps. That scan does not replace internal forensics; it only helps gauge whether related accounts may need password resets or further monitoring.