CVE-2022-21919: Windows User Profile Service Elevation of Privilege Vulnerability

CVE-2022-21919 is an elevation of privilege vulnerability in Windows User Profile Service, rated Important by Microsoft, with a CVSS 3.1 base score of 7 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. It was publicly disclosed before the fix was released. CISA added it to the Known Exploited Vulnerabilities catalog on 25 April 2022, with a remediation deadline of 16 May 2022 for US federal agencies. The EPSS model estimates a 2.57% probability of exploitation activity in the next 30 days, higher than 85% of all scored vulnerabilities. Microsoft released the fix on 11 January 2022 in the January 2022 Patch Tuesday, delivered through 15 security updates (KB5009557, KB5009545, KB5009543, KB5009555 and more). It affects 42 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-21919

Severity

High CVSS 7

Microsoft severity

Important

Impact

Elevation of Privilege

Exploited in the wild

No

Publicly disclosed

Yes

Exploitation likelihood

More Likely

Weakness

CWE-59

EPSS

2.57% (percentile 85%)

CISA KEV

Listed 25 April 2022, due 16 May 2022

Released

11 January 2022

Last updated

11 January 2022

Patch Tuesday

January 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-21919 at 7 (temporal 6.3) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected products (42)

Windows

ESU

Security updates (15)

• KB5009557 (Security Update)
• KB5009545 (Security Update)
• KB5009543 (Security Update)
• KB5009555 (Security Update)
• KB5009566 (Security Update)
• KB5009585 (Security Update)
• KB5009546 (Security Update)
• KB5009610 (Monthly Rollup)
• KB5009621 (Security Only)
• KB5009624 (Monthly Rollup)
• KB5009595 (Security Only)
• KB5009627 (Monthly Rollup)
• KB5009601 (Security Only)
• KB5009586 (Monthly Rollup)
• KB5009619 (Security Only)

Exploitation and detection

CISA Known Exploited Vulnerabilities

Date added

25 April 2022

Federal due date

16 May 2022

Ransomware use

Unknown

Required action

Apply updates per vendor instructions.

VulnCheck KEV

Date added

25 April 2022

Ransomware use

Unknown

Independent sources

1

• 25 April 2022 · cisa.gov
• 18 April 2023 · mandiant.widen.net
• 10 August 2023 · cisa.gov

Detection and weaponization

Weaponization maturity: Detection.

Sigma rules (1)

• Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE

NIST NVD data

NVD status

Analyzed

NVD CVSS

7 (HIGH)

NVD weakness

CWE-59

Published to NVD

11 January 2022

NVD last modified

30 October 2025

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21919 (Patch, Vendor Advisory)
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21919 (Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21919 (US Government Resource)

Revision history

Related vulnerabilities

Other Windows User Profile Service vulnerabilities

• CVE-2026-83659: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-62832: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7.8, August 2026)
• CVE-2022-26904: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7, April 2022)
• CVE-2022-21895: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2021-34484: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7.8, August 2021)
• CVE-2021-26873: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7, March 2021)
• CVE-2020-0785: Windows User Profile Service Elevation of Privilege Vulnerability (High, CVSS 7, March 2020)
• CVE-2020-0730: Windows User Profile Service Elevation of Privilege Vulnerability (Medium, CVSS 6.3, February 2020)

More from the January 2022 Patch Tuesday

• CVE-2013-3900: WinVerifyTrust Signature Validation Vulnerability (Medium, CVSS 5.5, exploited)
• CVE-2022-21882: Win32k Elevation of Privilege Vulnerability (High, CVSS 7, exploited)
• CVE-2022-21836: Windows Certificate Spoofing Vulnerability (High, CVSS 7.8)
• CVE-2022-21874: Windows Security Center API Remote Code Execution Vulnerability (High, CVSS 7.8)
• CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2022-21849: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2022-21885: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21897: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21908: Windows Installer Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21914: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21916: Windows Common Log File System Driver Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-21881: Windows Kernel Elevation of Privilege Vulnerability (High, CVSS 7)

All vulnerabilities of this release: January 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-21919
• NIST NVD: CVE-2022-21919
• CVE.org record: CVE-2022-21919
• CISA KEV catalog: CVE-2022-21919