Actively exploited in the wild
Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2022-04-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-26904
HighCVSS 7.0KEVSummary
A privilege elevation vulnerability in the Windows User Profile Service. It requires authentication as a local user.
Risk Assessment
An attacker with local access can gain higher privileges on the system, potentially leading to further host compromise.
Recommendation
Install the April 2022 security updates on all Windows workstations and servers.
Other vulnerabilities in Windows User Profile Service
See all- CVE-2022-21919HighActively exploited
Windows User Profile Service Elevation of Privilege Vulnerability.
- CVE-2021-34484HighActively exploited
An elevation of privilege vulnerability in the Windows User Profile Service.
- CVE-2026-62832High
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
- CVE-2021-26873High
Elevation of privilege vulnerability in Windows User Profile Service. Allows an attacker to gain higher privileges.
Original NVD description (English source)
Windows User Profile Service Elevation of Privilege Vulnerability