CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Windows User Profile Service Elevation of Privilege Vulnerability (CVE-2022-26904) Analysis and Mitigation Guide
[Affected Scope] Most Windows operating system versions, including Windows 10, 11, and Windows Server 2008 through 2022
[Impact] A locally authenticated attacker can exploit a race condition to execute arbitrary code with SYSTEM privileges, leading to complete system compromise
[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict multi-user interactive logins on unpatched systems
Windows User Profile Service Elevation of Privilege Vulnerability (CVE-2022-21919) Deep Dive & Mitigation Guide
[Affected Scope] Most Windows client and server operating systems, including Windows 10, 11, and Windows Server 2008 through 2022
[Impact] A locally authenticated attacker can exploit a symbolic link vulnerability to execute arbitrary code with SYSTEM privileges, leading to full system compromise
[Mitigation] Immediately apply the official Microsoft cumulative security updates and restrict local logon privileges in multi-user environments
Windows User Profile Service Elevation of Privilege Vulnerability (CVE-2021-34484) Analysis and Mitigation Guide
[Affected Scope] Windows 10, 11, and Windows Server systems running the User Profile Service (ProfSvc)
[Impact] A locally authenticated attacker can exploit a logical flaw to execute arbitrary code with SYSTEM privileges, leading to full system compromise
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict multi-user and RDP access if patching is delayed