CVE-2022-26904: Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Vulnerability summary

CVE-2022-26904 is a high (CVSS 7.0) Race Condition vulnerability in Microsoft Windows. It is known to be exploited: CISA lists it, first on 25-04-2022. EPSS estimates a 16.95% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-04-2022
   PublishedVulnerability first disclosed.
2. 25-04-2022
   Added to CISA KEVMicrosoft Windows User Profile Service Privilege Escalation Vulnerability
3. 16-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Windows User Profile Service Elevation of Privilege Vulnerability

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.