CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2022-44698) Analysis and Mitigation Guide
[Affected Scope] Windows 10, 11, and Windows Server 2016, 2019, 2022
[Impact] Attackers can bypass Windows SmartScreen and Mark of the Web (MotW) warnings, leading to unauthorized execution of malicious files without user alerts
[Mitigation] Apply the latest Microsoft Cumulative Updates immediately and enforce strict SmartScreen policies via GPO
Windows Scripting Engine JScript9 Remote Code Execution Vulnerability (CVE-2022-41128) Analysis and Mitigation Guide
[Affected Scope] Windows client and server environments utilizing the Windows Scripting Engine (JScript9)
[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the active user via crafted web content or documents
[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict the execution of legacy JScript engines
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability (CVE-2022-41125) Technical Advisory
[Affected Scope] Microsoft Windows operating systems including Windows 10, 11, and Windows Server 2012, 2016, 2019, 2022 utilizing the CNG Key Isolation service
[Impact] A local authenticated attacker can execute arbitrary code with SYSTEM privileges by running a specially crafted application, leading to complete system compromise
[Mitigation] Apply the official Microsoft Latest Cumulative Update (LCU) immediately and restrict local logon privileges for non-administrative users
Windows Mark of the Web (MotW) Security Feature Bypass Vulnerability (CVE-2022-41091) Analysis and Mitigation Guide
[Affected Scope] Microsoft Windows operating systems, including Windows 10, 11, and Windows Server editions
[Impact] Attackers can bypass the Mark of the Web (MotW) security warning, allowing malicious files to execute without triggering SmartScreen alerts
[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict execution of untrusted files
Windows Print Spooler Privilege Escalation Vulnerability (CVE-2022-41073) Security Advisory
[Affected Scope] Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 with the Print Spooler service enabled
[Impact] A local authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete system compromise
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the Print Spooler service on non-printing server infrastructures
Windows Mark of the Web (MotW) Security Feature Bypass Vulnerability (CVE-2022-41049) Deep Dive & Mitigation Guide
[Affected Scope] Microsoft Windows operating systems, including Windows 10, 11, and Windows Server editions
[Impact] Files downloaded from the internet may bypass the 'Mark of the Web (MotW)' flag, allowing malicious payloads to execute without SmartScreen warnings or Office Protected View restrictions
[Mitigation] Apply the latest Microsoft Cumulative Updates immediately, and restrict the extraction of untrusted archives (ZIP, ISO) until patched
Windows COM+ Event System Service Elevation of Privilege Vulnerability (CVE-2022-41033) Security Advisory
[Affected Scope] Multiple Windows operating system versions including Windows 7, 8.1, 10, 11, and Windows Server 2008, 2012, 2016, 2019, 2022
[Impact] A local authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete system compromise
[Mitigation] Immediately apply the official cumulative security updates provided by Microsoft and restrict unnecessary local user accounts and privileges
Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2022-38028) Security Advisory
[Affected Scope] Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 with active Print Spooler service
[Impact] Local authenticated attackers can execute arbitrary code with SYSTEM privileges, leading to complete system compromise
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the Print Spooler service on non-printing servers
Windows Common Log File System (CLFS) Driver Out-of-Bounds Write Elevation of Privilege Vulnerability (CVE-2022-37969) Analysis and Mitigation Guide
[Affected Scope] Almost all active versions of Windows OS, including Windows 7, 8.1, 10, 11, and Windows Server 2008 through 2022.
[Impact] A local attacker can exploit this vulnerability to gain SYSTEM privileges, leading to complete compromise of the target system.
[Mitigation] Immediately apply the September 2022 Microsoft security updates and monitor unpatched assets for anomalous local execution.
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability (CVE-2022-34713, Dogwalk)
[Affected Scope] Microsoft Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 supporting the MSDT protocol
[Impact] Successful exploitation allows remote attackers to execute arbitrary code on the target system when a user opens a specially crafted '.diagcab' file
[Mitigation] Apply the official Microsoft security updates immediately, or disable the MSDT URL protocol handler as a temporary workaround
Windows CSRSS Elevation of Privilege Vulnerability (CVE-2022-22047) Technical Advisory
[Affected Scope] Wide range of Windows operating systems including Windows 10, 11, and Windows Server 2008 through 2022
[Impact] A local authenticated attacker can exploit the vulnerability to execute arbitrary code with SYSTEM privileges by abusing the CSRSS process
[Mitigation] Immediately apply the Microsoft official Cumulative Update (LCU) and monitor for unauthorized local account activities and anomalous child processes
Microsoft Windows MSDT Remote Code Execution Vulnerability (Follina, CVE-2022-30190) Security Advisory
[Affected Scope] Windows Operating Systems and Microsoft Office applications utilizing the Microsoft Support Diagnostics Tool (MSDT) protocol
[Impact] Remote attackers can execute arbitrary code with the privileges of the calling application, potentially taking full control of the system
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the MSDT URL protocol handler via registry modification
Windows LSA Spoofing and NTLM Relay Vulnerability (CVE-2022-26925) Security Advisory
[Affected Scope] Windows and Windows Server operating systems, specifically Active Directory Domain Controllers
[Impact] Unauthenticated remote attackers can call methods on the LSARPC interface to coerce the Domain Controller to authenticate to an arbitrary target via NTLM, leading to full domain takeover
[Mitigation] Apply the official Microsoft cumulative security updates immediately, and enforce Extended Protection for Authentication (EPA) along with SMB signing to block NTLM relay paths
Windows User Profile Service Elevation of Privilege Vulnerability (CVE-2022-26904) Analysis and Mitigation Guide
[Affected Scope] Most Windows operating system versions, including Windows 10, 11, and Windows Server 2008 through 2022
[Impact] A locally authenticated attacker can exploit a race condition to execute arbitrary code with SYSTEM privileges, leading to complete system compromise
[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict multi-user interactive logins on unpatched systems
Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVE-2022-24521) Technical Analysis and Mitigation Guide
[Affected Scope] All supported versions of Windows 10, 11, and Windows Server 2008 through 2022.
[Impact] Local authenticated attackers can execute arbitrary code with kernel-level privileges (SYSTEM), leading to complete system compromise.
[Mitigation] Immediately apply the Microsoft official cumulative security updates and monitor for anomalous CLFS log creation and driver activities.
Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2022-22718) Security Advisory
[Affected Scope] Windows and Windows Server operating systems running the Windows Print Spooler service
[Impact] A locally authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete system compromise
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the Print Spooler service on non-printing servers
Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2022-21999) Technical Advisory
[Affected Scope] Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 with active Print Spooler service
[Impact] Local attackers can exploit directory traversal and symbolic link creation to execute arbitrary code with SYSTEM privileges, leading to full host compromise
[Mitigation] Apply the official Microsoft security updates immediately, or disable the Print Spooler service on non-printing servers and Domain Controllers
Windows Runtime Remote Code Execution Vulnerability (CVE-2022-21971) Security Advisory
[Affected Scope] Microsoft Windows operating systems utilizing Windows Runtime (WinRT), including Windows 10, Windows 11, and Windows Server 2016/2019/2022
[Impact] Successful exploitation allows an attacker to execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted file
[Mitigation] Apply the official Microsoft Cumulative Updates immediately and restrict execution of untrusted files
Windows User Profile Service Elevation of Privilege Vulnerability (CVE-2022-21919) Deep Dive & Mitigation Guide
[Affected Scope] Most Windows client and server operating systems, including Windows 10, 11, and Windows Server 2008 through 2022
[Impact] A locally authenticated attacker can exploit a symbolic link vulnerability to execute arbitrary code with SYSTEM privileges, leading to full system compromise
[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict local logon privileges in multi-user environments
Windows Win32k Kernel Local Privilege Escalation (LPE) Vulnerability Analysis and Mitigation Guide (CVE-2022-21882)
[Affected Scope] Windows 10, Windows 11, and Windows Server 2016/2019/2022 systems utilizing the Win32k kernel driver
[Impact] A local authenticated attacker can trigger kernel memory corruption (CWE-787) to execute arbitrary code with SYSTEM privileges
[Mitigation] Immediately apply the official Microsoft cumulative security updates (KB) and monitor for indicators of compromise (IoCs)