peter bassill · operator
$ cve CVE-2022-22047 JSON

CVE-2022-22047 KEV

7.8
HIGH · CVSS 3.1 · EPSS 18.8% (pctl 97)

Patch first

On CISA KEV — known exploited in the wild, due 2022-08-02.

Description

Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability

Scoring

CVSS7.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS18.77% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-426
On CISA KEVyes — remediate by 2022-08-02
Public exploitnone known
Published2022-07-12
Last modified2026-06-17

CISA KEV

NameMicrosoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability
Added2022-07-12
Due2022-08-02
Vendor / productMicrosoft / Windows
Ransomware usenone reported

Affected (16)

VendorProduct
microsoftwindows 10 1507
microsoftwindows 10 1607
microsoftwindows 10 1809
microsoftwindows 10 20h2
microsoftwindows 10 21h1
microsoftwindows 10 21h2
microsoftwindows 11 21h2
microsoftwindows 7
microsoftwindows 8.1
microsoftwindows rt 8.1
microsoftwindows server 2008
microsoftwindows server 2012
microsoftwindows server 2016
microsoftwindows server 2019
microsoftwindows server 2022
microsoftwindows server 20h2

References

→ the Explorer  ·  watch your stack  ·  NVD