CVE-2022-26904

HIGH(7.0)KEV

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Description

Windows User Profile Service Elevation of Privilege Vulnerability

KEV Information

Vendor
Microsoft
Product
Windows
Date Added
April 25, 2022
Due Date
May 16, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.0
Impact Score
5.9

CWEs

CWE-362Race Condition

Concurrent Execution using Shared Resource with Improper Synchronization

Affected Products

VendorProductVersion
microsoftwindows 10 1507< 10.0.10240.19265
microsoftwindows 10 1607< 10.0.14393.5066
microsoftwindows 10 1809< 10.0.17763.2803
microsoftwindows 10 1909< 10.0.18363.2212
microsoftwindows 10 20h2< 10.0.19042.1645
microsoftwindows 10 21h1< 10.0.19043.1645
microsoftwindows 10 21h2< 10.0.19044.1645
microsoftwindows 11 21h2< 10.0.22000.613
microsoftwindows 7-
microsoftwindows 8.1-
microsoftwindows rt 8.1-
microsoftwindows server 2008r2
microsoftwindows server 2012-; r2
microsoftwindows server 2016< 10.0.14393.5066
microsoftwindows server 2019< 10.0.17763.2803
microsoftwindows server 2022< 10.0.20348.643
microsoftwindows server 20h2< 10.0.19042.1645

References

CVSS Score

7.0
HIGH(7.0)

EPSS Score

EPSS Score9.82%
EPSS Percentile95.0%

Dates

PublishedApril 15, 2022
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch