CVE-2022-21999

Windows has a component called the Print Spooler that helps computers manage printing. This CVE is a security weakness that can let someone who already has a local foothold on the machine gain higher-level control than they should. In real incidents, that kind of increased access has been used as part of ransomware attacks—like getting the keys to more doors inside your building.

This matters if your organization runs any of the affected Windows versions (Windows 7, Windows 8.1, Windows 10, Windows 11, and the listed Windows Server releases) and the device has the Print Spooler in normal use. The weakness is not about remote browsing; it requires local access conditions (for example, an attacker already having a foothold such as a user account or similar local access). The urgency is driven by CISA listing this CVE because it has been used in ransomware campaigns.

This is RED because CISA has confirmed it was used in ransomware campaigns and added it to the KEV catalog. That means attackers are actively targeting Windows systems to gain higher privileges as a step toward deeper compromise. The CISA remediation due date for this KEV was 2022-04-15, so systems that are not yet updated should be treated as already overdue.

1. Confirm scope (which devices are affected):

   • Inventory all endpoints and servers running the affected Windows versions (Windows 7, Windows Server 2008/2008 R2, Windows 8.1, Windows 10, Windows RT 8.1, and Windows Server 2012/2012 R2/2016/2019/2022).
   • Focus on machines where printing/Print Spooler is in normal operation (or where the component is installed/enabled by default).

2. Check current patch level:

   • On each device, check installed Windows updates and/or OS build/revision to determine whether it matches a “fixed in” build listed for your OS branch.
   • If you maintain a vulnerability management tool, run a targeted scan for CVE-2022-21999 and confirm results against the fixed build list.

3. Apply the correct fixed version (per OS branch):

   • Windows 10 fixed builds: 10.0.10240.19204 OR 10.0.14393.4946 OR 10.0.17763.2565 OR 10.0.18363.2094 OR 10.0.19042.1526 OR 10.0.19043.1526 OR 10.0.19044.1526.
   • Windows 11 fixed build: 10.0.22000.493.
   • Windows Server 2016 fixed build: 10.0.14393.4946.
   • Windows Server 2019 fixed build: 10.0.17763.2565.
   • Windows Server 2022 fixed build: 10.0.20348.524.
   • Use Microsoft’s vendor guidance for applying updates for CVE-2022-21999.

4. Timing and required action:

   • This CVE is in CISA KEV (added 2022-03-25) with remediation due 2022-04-15; treat any non-compliant machines as a priority remediation target.

5. If you cannot patch immediately (temporary mitigation while scheduling updates):

   • Reduce the chance of local footholds: review access controls and ensure only trusted users can log on locally.
   • Restrict or closely monitor printing-related activities and ensure least-privilege for accounts that can reach the machine.
   • Increase monitoring for suspicious local privilege changes and unusual behavior around print-related services.
   • (Note: these actions help reduce risk but do not replace patching.)

6. Verify and monitor after patching:

   • Re-scan/verify that CVE-2022-21999 is no longer present on each machine.
   • Review event logs for suspicious privilege escalation patterns and unexpected administrative activity from accounts that should not have had it.

Reference for vendor update guidance is provided by Microsoft’s update guide for CVE-2022-21999.

Severity is high (CVSS 7.8) and the issue is a Windows Print Spooler elevation of privilege weakness. CISA KEV confirms this CVE was used in ransomware campaigns, making exploitation an established reality. The weakness is triggered via the Print Spooler component and is reached under local-access conditions rather than purely remote access. No public exploit code is noted in the findings, but KEV status still requires treating it as actively targeted. Patch availability exists via specific Microsoft fixed OS build revisions listed in the findings. KEV means CISA identified this flaw as being used in real attacks and requires remediation by the due date to reduce ongoing risk.