FortiGuard Labs is aware that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2022-22718 to the Known Exploited Vulnerabilities Catalog. CVE-2022-24481 is a local privilege escalation vulnerability in the Windows Print Spooler and affects multiple versions of Windows OS. Microsoft issued a patch for the vulnerability as part of the February 2022 Patch Tuesday updates.Why is this Significant?This is significant because CISA’s Known Exploited Vulnerabilities Catalog lists vulnerabilities that are known to be exploited in the wild. Although Microsoft rated CVE-2022-22718 as “Exploitation More Likely” in their advisory, the vulnerability is now on the active exploitation list as such the patch for CVE-2022-22718 should be applied as soon as possible.What is CVE-2022-22718?CVE-2022-22718 is a local privilege escalation vulnerability in the Windows Print Spooler and affects multiple versions of Windows OS. Successfully exploiting the vulnerability allows a local attacker to elevate privileges. CVE-2022-22718 has a CVSS score of 7.8. Has Microsoft Released an Advisory for CVE-2022-22718?Yes, Microsoft released an advisory on February 8, 2022. See the Appendix for a link to “Windows Print Spooler Elevation of Privilege Vulnerability – CVE-2022-22718”.Has Microsoft Released a Patch for CVE-2022-22718?Yes, Microsoft released a patch as part of the February 2022 Patch Tuesday (February 8th, 2022).What is the Status of Coverage?FortiGuard Labs has the following IPS signature against CVE-2022-22718:MS.Windows.Print.Spooler.CVE-2022-22718.Privilege.Elevation
