CVE-2022-22047: Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability

CVE-2022-22047 is a privilege-escalation vulnerability in the Microsoft Windows Client Server Runtime Subsystem (CSRSS). An attacker who already has a foothold on a Windows system can abuse it to obtain SYSTEM-level privileges. That jump from ordinary user rights to full system control is why the issue matters to IT and security teams: it turns limited access into complete host compromise and can enable further lateral movement or persistence. Confirm all product and update details against the Microsoft vendor advisory.

How it works

The weakness is classified as CWE-426 (Untrusted Search Path). In this class of flaw, a privileged component searches for or loads a resource (such as a library or executable) from a location an attacker can influence. CSRSS is a core Windows subsystem that runs with high privileges and handles process and window-station management. When the search path or load order is not properly constrained, a lower-privileged process can place a malicious file where CSRSS will pick it up, causing the privileged component to execute attacker-controlled code and elevate to SYSTEM.

Public detail on the exact load sequence or trigger conditions is limited; treat the abuse path as a classic local privilege-escalation technique that requires the attacker already to be able to run code on the target. Do not assume remote, unauthenticated exploitation. Specifics of the vulnerable code path must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

CSRSS is present on essentially every supported Microsoft Windows client and server installation; the component is part of the base operating system rather than an optional role. Inventory efforts should therefore focus on Windows endpoints and servers rather than on a separate application.

• Enumerate Windows builds and patch levels with your existing asset-management, CMDB, or vulnerability-scanning tools; flag any host that has not received the security update that addresses CVE-2022-22047.
• Confirm the exact affected builds and the corresponding KB or cumulative update by reading the Microsoft advisory; do not rely on version guesses.
• Look for signs of local privilege-escalation activity in security telemetry: unexpected processes spawning as SYSTEM from non-SYSTEM parents, unusual module loads into csrss.exe, or creation of suspicious files in directories that appear in the system or user search path.
• Review EDR or Sysmon logs for process-creation and image-load events involving CSRSS around the time of suspected compromise. Absence of clear indicators does not prove safety; patch status remains the primary signal.

How to remediate

Patch first. Apply the Microsoft security update that remediates CVE-2022-22047 according to the vendor instructions and your normal change process. CISA’s required action is simply to apply updates per vendor instructions; follow that guidance and verify installation via your patch-management console or by checking the relevant KB on each host.

After patching, harden the environment against the broader untrusted-search-path class:

• Ensure standard users cannot write to directories that appear early in the system or application search path.
• Prefer absolute paths and safe DLL-search-order settings for any custom or third-party software that interacts with privileged Windows components.
• Keep endpoint-protection and attack-surface-reduction rules enabled so that unexpected module loads or process injections are blocked or at least alerted.

If you can't patch immediately

Until the vendor update can be deployed, reduce risk with compensating controls:

• Segment high-value systems so that a compromised low-privilege user account has limited network reach.
• Enforce least privilege: remove local administrator rights from standard users and restrict interactive logon where possible.
• Increase monitoring on process creation, image loads, and privilege-use events involving csrss.exe and other SYSTEM processes; alert on anomalies.
• If your EDR or host firewall supports application-control or path-based restrictions, block execution from user-writable locations that could be used for search-path abuse.
• Virtual patching via network controls is of limited value for a local elevation issue, but still useful for containing post-exploitation traffic.

These measures lower likelihood and impact; they do not replace the official patch.

If your data may have been exposed

Actively exploited privilege-escalation vulnerabilities frequently appear in breach chains even when ransomware use is not documented for the specific CVE. If you have evidence of exploitation or unexplained SYSTEM-level activity, treat the host as compromised: isolate it, collect forensic images, rotate credentials that may have been exposed, and hunt for persistence. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data to see whether associated accounts already appear in public dumps.