CVE-2022-26904: Microsoft Windows User Profile Service Privilege Escalation Vulnerability

CVE-2022-26904 is a privilege-escalation vulnerability in the Microsoft Windows User Profile Service. An attacker who already has a foothold on a system could abuse it to gain higher privileges. Because the User Profile Service is present on typical Windows endpoints and servers, successful exploitation can turn a limited compromise into full administrative control, which is why defenders need to treat it as a priority.

Public detail on the exact mechanics is limited; CISA describes an unspecified flaw that allows privilege escalation. Confirm all version, patch, and configuration specifics against the Microsoft vendor advisory before acting.

How it works

The weakness is classified as CWE-362, a race-condition issue (concurrent execution using a shared resource with improper synchronization). In this class of flaw, two or more operations race to access or modify the same resource; if the timing is wrong, an attacker can interleave their own actions and obtain a result the software never intended—here, elevated privileges via the User Profile Service.

An attacker who can already run code in a lower-privileged context would attempt to win the race against legitimate User Profile Service operations. Exact exploit steps are not publicly detailed in the provided facts, so treat any proof-of-concept claims with caution and rely on the vendor advisory for technical depth. The outcome of a successful race is privilege escalation on the local Windows host.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Windows systems that include the User Profile Service, which is a standard component on client and server editions. Inventory every Windows endpoint and server in your environment—workstations, jump hosts, remote-desktop servers, and domain-joined or standalone machines.

• Use your software and patch-management inventory (SCCM/ConfigMgr, Intune, WSUS, third-party vulnerability scanners) to list installed Windows builds and the presence of the User Profile Service.
• Compare each build against the fixed versions listed in the Microsoft advisory for CVE-2022-26904; do not assume a build is safe without that confirmation.
• Review local and central logs for unusual activity tied to user-profile loading, service control-manager events, or sudden elevation of low-privileged processes. Race-condition exploitation often leaves subtle timing artifacts rather than loud errors, so correlate process-creation and privilege-change events around profile service activity.
• On systems that cannot be patched immediately, note any custom profile-handling scripts or third-party tools that interact with the service; these may increase exposure.

How to remediate

Patch first. Apply the updates Microsoft released for this vulnerability exactly as directed in the vendor advisory. CISA’s required action is to apply updates per vendor instructions; that remains the primary fix.

• Deploy the security update through your normal Windows Update, WSUS, or enterprise patch channel, prioritizing internet-facing and high-value hosts.
• After installation, verify the expected build or file versions match the advisory and reboot if required so the User Profile Service loads the corrected code.
• For the broader race-condition class, reduce the window of opportunity by keeping systems current, limiting the number of accounts that can interact with profile services, and ensuring least-privilege execution for all user-mode processes.
• Retire or isolate legacy Windows versions that no longer receive updates.

If you can't patch immediately

Until the vendor update can be applied, reduce risk with compensating controls.

• Segment hosts so that a compromised low-privilege account cannot easily reach high-value systems; enforce network and host firewall rules that limit lateral movement.
• Apply application-control or attack-surface-reduction policies that restrict which binaries may interact with the User Profile Service or load into privileged contexts.
• If a host-based or network virtual-patching capability (WAF, IPS, EDR behavioral block) offers a signature or behavioral rule for this CVE or for User Profile Service race conditions, enable it after testing.
• Disable or restrict any non-essential features that trigger frequent profile loads if your environment allows it, and monitor the service more closely with EDR or Sysmon-style process and token auditing.
• Increase logging of privilege-change and service-related events and alert on anomalies until the patch is in place.

If your data may have been exposed

Actively exploited privilege-escalation vulnerabilities frequently serve as a stepping stone to broader compromise and data theft. While known ransomware use is not documented for this CVE, any successful elevation can lead to credential dumping, lateral movement, and exfiltration. If you suspect exploitation, isolate affected hosts, preserve forensic evidence, rotate credentials that may have been exposed, and follow your incident-response plan. You can also run a free exposure scan of your email addresses against known breach data to check whether associated accounts have appeared in prior incidents.