CVE-2022-41033: Windows COM+ Event System Service Elevation of Privilege Vulnerability

CVE-2022-41033 is an elevation of privilege vulnerability in Windows COM+ Event System Service, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft reports that it has been exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 11 October 2022, with a remediation deadline of 1 November 2022 for US federal agencies. The EPSS model estimates a 1.89% probability of exploitation activity in the next 30 days, higher than 80% of all scored vulnerabilities. Microsoft released the fix on 11 October 2022 in the October 2022 Patch Tuesday, delivered through 15 security updates (KB5018419, KB5018410, KB5018421, KB5018418 and more). It affects 40 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-41033

Severity

High CVSS 7.8

Microsoft severity

Important

Impact

Elevation of Privilege

Exploited in the wild

Yes

Publicly disclosed

No

Exploitation likelihood

Detected

Weakness

CWE-843

EPSS

1.89% (percentile 80%)

CISA KEV

Listed 11 October 2022, due 1 November 2022

Released

11 October 2022

Last updated

11 October 2022

Patch Tuesday

October 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-41033 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (40)

Windows

ESU

Security updates (15)

• KB5018419 (Security Update)
• KB5018410 (Security Update)
• KB5018421 (Security Update)
• KB5018418 (Security Update)
• KB5018427 (Security Update)
• KB5018425 (Security Update)
• KB5018411 (Security Update)
• KB5018454 (Monthly Rollup)
• KB5018479 (Security Only)
• KB5018474 (Monthly Rollup)
• KB5018476 (Security Only)
• KB5018450 (Monthly Rollup)
• KB5018446 (Security Only)
• KB5018457 (Monthly Rollup)
• KB5018478 (Security Only)

Exploitation and detection

CISA Known Exploited Vulnerabilities

Date added

11 October 2022

Federal due date

1 November 2022

Ransomware use

Unknown

Required action

Apply updates per vendor instructions.

VulnCheck KEV

Date added

11 October 2022

Ransomware use

Unknown

Independent sources

2

• 11 October 2022 · api.msrc.microsoft.com
• 11 October 2022 · docs.google.com
• 11 October 2022 · cisa.gov
• 17 January 2023 · raw.githubusercontent.com

NIST NVD data

NVD status

Analyzed

NVD CVSS

7.8 (HIGH)

NVD weakness

CWE-843

Published to NVD

11 October 2022

NVD last modified

13 January 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41033 (Patch, Vendor Advisory)
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41033 (Patch, Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41033 (US Government Resource)

Acknowledgments

• Anonymous

Revision history

Related vulnerabilities

Other Windows COM+ Event System Service vulnerabilities

• CVE-2026-113769: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7, November 2026)
• CVE-2026-113767: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7.8, November 2026)
• CVE-2026-119855: Windows COM+ Event System Service Information Disclosure Vulnerability (Medium, CVSS 5.5, November 2026)
• CVE-2026-96933: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-83848: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-83830: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-83785: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7, October 2026)
• CVE-2025-58725: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7, October 2025)

More from the October 2022 Patch Tuesday

• CVE-2022-37970: Windows DWM Core Library Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37987: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37989: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37997: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38028: Windows Print Spooler Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38050: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38051: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-34689: Windows CryptoAPI Spoofing Vulnerability (High, CVSS 7.5)
• CVE-2022-37974: Windows Mixed Reality Developer Tools Information Disclosure Vulnerability (Medium, CVSS 6.5)
• CVE-2022-37975: Windows Group Policy Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-37976: Active Directory Certificate Services Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-37982: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (High, CVSS 8.8)

All vulnerabilities of this release: October 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-41033
• NIST NVD: CVE-2022-41033
• CVE.org record: CVE-2022-41033
• CISA KEV catalog: CVE-2022-41033