PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-26904 Microsoft CVE debrief

CVE-2022-26904 is a Microsoft Windows privilege escalation vulnerability affecting the User Profile Service. CISA included it in the Known Exploited Vulnerabilities catalog on 2022-04-25, which makes it a high-priority remediation item for Windows environments. The supplied corpus does not include a CVSS score, so operational urgency should be driven by the KEV listing and your exposure to affected Windows systems.

Vendor
Microsoft
Product
Windows
CVSS
HIGH 7
CISA KEV
Listed
Original CVE published
2022-04-25
Original CVE updated
2022-04-25
Advisory published
2022-04-25
Advisory updated
2022-04-25

Who should care

Windows administrators, endpoint security teams, patch management teams, and defenders responsible for systems where users can log on locally or remotely should prioritize this issue. Security teams should also pay attention because CISA has identified it as known exploited.

Technical summary

The supplied sources identify CVE-2022-26904 as a privilege escalation vulnerability in Microsoft Windows User Profile Service. Beyond that classification, the provided corpus does not include additional technical details, exploit mechanics, or affected-version specifics. CISA’s KEV entry indicates the vulnerability was considered actively relevant enough to require remediation per vendor guidance.

Defensive priority

High. CISA’s Known Exploited Vulnerabilities listing is a strong signal that this issue should be remediated quickly, especially on internet-connected, user-facing, or broadly deployed Windows endpoints and servers.

Recommended defensive actions

  • Apply Microsoft updates per vendor instructions as soon as possible.
  • Use the CISA KEV catalog to confirm remediation status and due-date pressure.
  • Inventory Windows systems that rely on the User Profile Service and verify patch coverage.
  • Prioritize high-value, remote-access, and widely deployed endpoints for validation.
  • Monitor for anomalous privilege changes or unexpected administrative access on affected systems.

Evidence notes

Evidence is limited to the supplied CISA KEV metadata and official links. The source data shows: CVE ID CVE-2022-26904; vendor Microsoft; product Windows; vulnerability name 'Microsoft Windows User Profile Service Privilege Escalation Vulnerability'; dateAdded 2022-04-25; dueDate 2022-05-16; knownRansomwareCampaignUse Unknown; and requiredAction 'Apply updates per vendor instructions.' No CVSS score or deeper technical exploit details were provided in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-26904 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-26904

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-26904 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-26904

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.