CVE-2022-26904

Windows User Profile Service Elevation of Privilege Vulnerability

High7.0Known exploitedPublic exploitEPSS 16.9%

Published: 15 Apr 2022
Updated: 21 Oct 2025
Reserved: 11 Mar 2022
Assigned by: microsoft

Description

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Microsoft Windows User Profile Service Privilege Escalation Vulnerability.

Added: 25 Apr 2022
Fix due (US federal): 16 May 2022
Used by ransomware: Not known

Apply updates per vendor instructions.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: it is being exploited.

Timeline

2022
11 Mar 2022
11 Mar 2022
ID reserved
By microsoft
15 Apr 202235 days later
15 Apr 2022· 35 days later
Published
25 Apr 202210 days later
25 Apr 2022· 10 days later
Added to CISA KEV
Known exploited in the wild
2025
21 Oct 20253 years later
21 Oct 2025· 3 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-26904, by who scored it
Scored by	CVSS	Score	Vector
microsoftCNA (assigner)	3.1	High7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
NVDNVD · Analyzed	3.1	High7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 16.9% · top 2.9% of all CVEs (8 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

Affected products

Microsoft · Windows 10 Version 1809
- affected 10.0.17763.0 – < 10.0.17763.2803
Microsoft · Windows 10 Version 1809
- affected 10.0.0 – < 10.0.17763.2803
Microsoft · Windows Server 2019
- affected 10.0.17763.0 – < 10.0.17763.2803
Microsoft · Windows Server 2019 (Server Core installation)
- affected 10.0.17763.0 – < 10.0.17763.2803
Microsoft · Windows 10 Version 1909
- affected 10.0.0 – < 10.0.18363.2212
Microsoft · Windows 10 Version 21H1
- affected 10.0.0 – < 10.0.19043.1645
Microsoft · Windows Server 2022
- affected 10.0.20348.0 – < 10.0.20348.643
Microsoft · Windows 10 Version 20H2
- affected 10.0.0 – < 10.0.19042.1645
Microsoft · Windows Server version 20H2
- affected 10.0.0 – < 10.0.19042.1645
Microsoft · Windows 11 version 21H2
- affected 10.0.0 – < 10.0.22000.613
Microsoft · Windows 10 Version 21H2
- affected 10.0.19043.0 – < 10.0.19044.1645
Microsoft · Windows 10 Version 1507
- affected 10.0.10240.0 – < 10.0.10240.19265
Microsoft · Windows 10 Version 1607
- affected 10.0.14393.0 – < 10.0.14393.5066
Microsoft · Windows Server 2016
- affected 10.0.14393.0 – < 10.0.14393.5066
Microsoft · Windows Server 2016 (Server Core installation)
- affected 10.0.14393.0 – < 10.0.14393.5066
Microsoft · Windows 7
- affected 6.1.0 – < 6.1.7601.25924
Microsoft · Windows 7 Service Pack 1
- affected 6.1.0 – < 6.1.7601.25924
Microsoft · Windows 8.1
- affected 6.3.0 – < 6.3.9600.20337
Microsoft · Windows Server 2008 Service Pack 2
- affected 6.0.6003.0 – < 6.0.6003.21446
Microsoft · Windows Server 2008 Service Pack 2 (Server Core installation)
- affected 6.0.6003.0 – < 6.0.6003.21446
Microsoft · Windows Server 2008 Service Pack 2
- affected 6.0.6003.0 – < 6.0.6003.21446
Microsoft · Windows Server 2008 R2 Service Pack 1
- affected 6.1.7601.0 – < 6.1.7601.25924
Microsoft · Windows Server 2008 R2 Service Pack 1 (Server Core installation)
- affected 6.1.7601.0 – < 6.1.7601.25924
Microsoft · Windows Server 2012
- affected 6.2.9200.0 – < 6.2.9200.23679
Microsoft · Windows Server 2012 (Server Core installation)
- affected 6.2.9200.0 – < 6.2.9200.23679
Microsoft · Windows Server 2012 R2
- affected 6.3.9600.0 – < 6.3.9600.20337
Microsoft · Windows Server 2012 R2 (Server Core installation)
- affected 6.3.9600.0 – < 6.3.9600.20337

References (2)

Windows User Profile Service Elevation of Privilege Vulnerability (opens in a new tab)vendor-advisoryx_transferred
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26904 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-26904](https://cveledger.app/badge/CVE-2022-26904.svg)](https://cveledger.app/cve/CVE-2022-26904)

Record last updated 21 Oct 2025, 23:15 UTC.