What is the fix for CVE-2022-41125?

Apply the Microsoft Windows updates per vendor instructions; the sources do not name the patched build.

Live › vulnerability › CVE-2022-41125

high7.8Exploited in the wildInfrastructure

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

A flaw in the Windows CNG Key Isolation Service lets a local attacker gain SYSTEM-level privileges. CISA lists it as actively exploited in the wild.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Nov 8, 2022 UTC
Last modified: Aug 10, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Nov 8, 2022.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Attacker with local low-privilege access gets full SYSTEM control of the machine.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2022-41125

Go to dashboard

high7.8Exploited in the wildInfrastructure

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

A flaw in the Windows CNG Key Isolation Service lets a local attacker gain SYSTEM-level privileges. CISA lists it as actively exploited in the wild.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.8

high

scored by [email protected]

known so far4 of 6

missing: how to check, primary source

First public: Nov 8, 2022 UTC
Last modified: Aug 10, 2026
Status: open
Known exploitation: Listed in CISA KEV
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, on CISA KEV since Nov 8, 2022.
Needs login: Yes.
Needs a special setup: No.
Reachable from: local.
Worst case: Attacker with local low-privilege access gets full SYSTEM control of the machine.
CVSS said: 7.8. The facts above say critical; exploitation in the wild moves it to high.

Known exploitation

CISA KEV

Know the next one before it finds you.

Add to Slack

Product	Ecosystem	Affected	Fixed in
Microsoft Windows	vendor	–	–
microsoft windows 10 1507	vendor	< 10.0.10240.19567	10.0.10240.19567
microsoft windows 10 1607	vendor	< 10.0.14393.5501	10.0.14393.5501
microsoft windows 10 1809	vendor	< 10.0.17763.3650	10.0.17763.3650
microsoft windows 10 20h2	vendor	< 10.0.19042.2251	10.0.19042.2251
microsoft windows 10 21h1	vendor	< 10.0.19043.2251	10.0.19043.2251
microsoft windows 10 21h2	vendor	< 10.0.19044.2251	10.0.19044.2251
microsoft windows 10 22h2	vendor	< 10.0.19045.2251	10.0.19045.2251
microsoft windows 11 21h2	vendor	< 10.0.22000.1219	10.0.22000.1219
microsoft windows 11 22h2	vendor	< 10.0.22621.819	10.0.22621.819
microsoft windows 8.1	vendor	–	–
microsoft windows server 2012	vendor	–	–
microsoft windows server 2012	vendor	= r2	–
microsoft windows server 2016	vendor	< 10.0.14393.5501	10.0.14393.5501
microsoft windows server 2019	vendor	< 10.0.17763.3650	10.0.17763.3650
microsoft windows server 2022	vendor	< 10.0.20348.1249	10.0.20348.1249

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Why it is high, and not just CVSS

Known exploitation

Know the next one before it finds you.

Who is affected

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources