{"id":"CVE-2022-38028","kind":"vulnerability","aliases":["CVE-2022-38028"],"related":[],"title":"Windows Print Spooler Elevation of Privilege Vulnerability","description":"Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"The Windows Print Spooler service has a privilege escalation flaw that lets a local user modify a JavaScript constraints file and have it executed with SYSTEM permissions. An attacker with a foothold on a Windows machine gets full control of that machine.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-04-23T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":["10.0.10240.19507"],"affected":"< 10.0.10240.19507","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.5427"],"affected":"< 10.0.14393.5427","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.3532"],"affected":"< 10.0.17763.3532","ecosystem":"vendor"},{"name":"microsoft windows 10 20h2","fixed":["10.0.19042.2130"],"affected":"< 10.0.19042.2130","ecosystem":"vendor"},{"name":"microsoft windows 10 21h1","fixed":["10.0.19043.2130"],"affected":"< 10.0.19043.2130","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.2130"],"affected":"< 10.0.19044.2130","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.674"],"affected":"< 10.0.22621.674","ecosystem":"vendor"},{"name":"microsoft windows 8.1","fixed":["6.3.9600.20625"],"affected":"< 6.3.9600.20625","ecosystem":"vendor"},{"name":"microsoft windows rt 8.1","fixed":["6.3.9600.20625"],"affected":"< 6.3.9600.20625","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.5427"],"affected":"< 10.0.14393.5427","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.3532"],"affected":"< 10.0.17763.3532","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.1129"],"affected":"< 10.0.20348.1129","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","print-spooler","windows"],"not_affected_if":["print-spooler-disabled"],"how_to_check":null,"fix":"Apply the Microsoft update for CVE-2022-38028 or follow the vendor mitigation; CISA says to apply mitigations per vendor instructions or discontinue use if none are available.","status":"open","published_at":"2022-10-11T19:15:15+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:00:48+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:00:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for CVE-2022-38028 or follow the vendor mitigation; CISA says to apply mitigations per vendor instructions or discontinue use if none are available.","reach":"local","impact":"high","summary":"The Windows Print Spooler service has a privilege escalation flaw that lets a local user modify a JavaScript constraints file and have it executed with SYSTEM permissions. An attacker with a foothold on a Windows machine gets full control of that machine.","category":"infrastructure","who_cares":["windows","print-spooler"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains SYSTEM-level code execution on the Windows machine","analyst_note":"Sources do not name affected Windows builds or the exact patch KB; check Microsoft's CVE-2022-38028 advisory for affected versions and the update or mitigation steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["print-spooler-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000475,"input_tokens":2829,"output_tokens":384,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':9A,12A '-38028':10A,13A '10':18A,22A,26A,30A,34A,38A '11':42A '1507':19A '1607':23A '1809':27A '2012':54A,58A '2016':62A '2019':66A '2022':70A '20h2':31A '21h1':35A '21h2':39A '22h2':43A '8.1':46A,50A 'action':147C 'appli':148C 'attack':105B,130C 'cisa':145C 'constraint':95B,135C 'contain':124C 'control':115B 'cve':8A,11A 'discontinu':154C 'elev':4A 'escal':85B,127C 'execut':100B,138C 'exploit':71B 'file':96B,136C 'flaw':86B 'foothold':108B 'full':114B 'get':113B 'infrastructur':72B 'instruct':152C 'javascript':94B,134C 'let':88B 'level':143C 'local':90B 'machin':112B,118B 'may':131C 'microsoft':14A,16A,20A,24A,28A,32A,36A,40A,44A,47A,51A,55A,59A,63A,67A,119C 'mitig':149C,160C 'modifi':92B,132C 'per':150C 'permiss':103B,144C 'print':2A,74B,79B,121C 'print-spool':73B 'privileg':6A,84B,126C 'product':158C 'requir':146C 'rt':49A 'server':53A,57A,61A,65A,69A 'servic':81B,123C 'spooler':3A,75B,80B,122C 'system':102B,142C 'system-level':141C 'unavail':162C 'use':155C 'user':91B 'vendor':151C 'vulner':7A,128C 'window':1A,76B,78B,111B,120C 'windows':15A,17A,21A,25A,29A,33A,37A,41A,45A,48A,52A,56A,60A,64A,68A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-10-11T19:15:15+00:00","kev":{"dateAdded":"2024-04-23","dueDate":"2024-05-14","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.  ","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-38028","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-38028","severity":null,"published_at":"2024-04-23T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:39+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-38028","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38028","severity":null,"published_at":"2022-10-11T19:15:15+00:00","modified_at":"2026-06-17T04:55:56+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}