Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

TACTICThreat Analysis & Cyber Threat Intelligence Center
System themeFrançais

Back to the watch

CVE-2022-26904

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

UrgentCVSS 7.0 v3.1Exploited

Why this priority

?

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

  • Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.

Affected products

VendorProductVersions
MicrosoftWindows 10 Version 1507
  • from 10.0.10240.0 to 10.0.10240.19265 excluded
MicrosoftWindows 10 Version 1607
  • from 10.0.14393.0 to 10.0.14393.5066 excluded
MicrosoftWindows 10 Version 1809
  • from 10.0.0 to 10.0.17763.2803 excluded
MicrosoftWindows 10 Version 1809
  • from 10.0.17763.0 to 10.0.17763.2803 excluded
MicrosoftWindows 10 Version 1909
  • from 10.0.0 to 10.0.18363.2212 excluded
MicrosoftWindows 10 Version 20H2
  • from 10.0.0 to 10.0.19042.1645 excluded
MicrosoftWindows 10 Version 21H1
  • from 10.0.0 to 10.0.19043.1645 excluded
MicrosoftWindows 10 Version 21H2
  • from 10.0.19043.0 to 10.0.19044.1645 excluded
MicrosoftWindows 11 version 21H2
  • from 10.0.0 to 10.0.22000.613 excluded
MicrosoftWindows 7 Service Pack 1
  • from 6.1.0 to 6.1.7601.25924 excluded
MicrosoftWindows 7
  • from 6.1.0 to 6.1.7601.25924 excluded
MicrosoftWindows 8.1
  • from 6.3.0 to 6.3.9600.20337 excluded
MicrosoftWindows Server 2008 Service Pack 2
  • from 6.0.6003.0 to 6.0.6003.21446 excluded
MicrosoftWindows Server 2008 R2 Service Pack 1 (Server Core installation)
  • from 6.1.7601.0 to 6.1.7601.25924 excluded
MicrosoftWindows Server 2008 R2 Service Pack 1
  • from 6.1.7601.0 to 6.1.7601.25924 excluded
MicrosoftWindows Server 2008 Service Pack 2 (Server Core installation)
  • from 6.0.6003.0 to 6.0.6003.21446 excluded
MicrosoftWindows Server 2008 Service Pack 2
  • from 6.0.6003.0 to 6.0.6003.21446 excluded
MicrosoftWindows Server 2012 (Server Core installation)
  • from 6.2.9200.0 to 6.2.9200.23679 excluded
MicrosoftWindows Server 2012 R2 (Server Core installation)
  • from 6.3.9600.0 to 6.3.9600.20337 excluded
MicrosoftWindows Server 2012 R2
  • from 6.3.9600.0 to 6.3.9600.20337 excluded
MicrosoftWindows Server 2012
  • from 6.2.9200.0 to 6.2.9200.23679 excluded
MicrosoftWindows Server 2016 (Server Core installation)
  • from 10.0.14393.0 to 10.0.14393.5066 excluded
MicrosoftWindows Server 2016
  • from 10.0.14393.0 to 10.0.14393.5066 excluded
MicrosoftWindows Server 2019 (Server Core installation)
  • from 10.0.17763.0 to 10.0.17763.2803 excluded
MicrosoftWindows Server 2019
  • from 10.0.17763.0 to 10.0.17763.2803 excluded
MicrosoftWindows Server 2022
  • from 10.0.20348.0 to 10.0.20348.643 excluded
MicrosoftWindows Server version 20H2
  • from 10.0.0 to 10.0.19042.1645 excluded
MicrosoftWindowsAll versions

Revision history

  1. Revision 3

  2. Revision 2

    Update : Affected versions changed

  3. Revision 1

    New record

Qualification

CVSS severity
?

Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary

7.0 HIGH CVSS v3.1CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
KEV catalog
?

CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary

Listed
Exploitation
Confirmed
EPSS probability
?

Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary

Unknown
Confidence
?

Quality of the sources behind the record. It is not a risk score. See the glossary

High

Priority rules, version 1

CISA KEV catalog

Added on
25 April 2022
Federal due date
16 May 2022
Required action
Apply updates per vendor instructions.
Ransomware use
Unknown

Record

Published on
15 April 2022
Weaknesses (CWE)
CWE-362

Sources

References

CVE-2022-26904 Microsoft Windows User Profile Service Privilege Escalation Vulnerability · Avanguard TACTIC