CVE-2022-38028VulnerabilityPublished 04/23/2024Updated 10/24/2026
CVE-2022-38028: Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Affects Microsoft WindowsSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 04/23/2024
- KEV deadline
- 05/14/2024
- EPSS
- 14.9% chance of exploitation in 30 days – higher than 96% of CVEs
What to do
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.