PT-2022-5458 · Microsoft · Windows 10+2

Published 2022-10-11 · Updated 2026-06-12 · CVE-2022-38028

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows 10 versions prior to 10.0.10240.19507 Microsoft Windows 10 versions prior to 10.0.14393.5427 Microsoft Windows 10 versions prior to 10.0.17763.3532 Microsoft Windows 10 versions prior to 10.0.19042.2130 Microsoft Windows 10 versions prior to 10.0.19043.2130

Description The vulnerability is related to the Windows Print Spooler service and is associated with insufficient access restrictions. It allows attackers to elevate their privileges within the system. The issue has been exploited by the Russian hacking group Forest Blizzard, also known as APT28, using a custom tool called GooseEgg. This tool has been used to target organizations in Ukraine, Western Europe, and North America. The vulnerability has been used in conjunction with other exploits to gain system privileges. There have been reports of real-world incidents where this issue was exploited, including a case where attackers used the vulnerability to compromise a company's computer and steal credentials.

Recommendations For Microsoft Windows 10 versions prior to 10.0.10240.19507, update to a version that contains the fix for this vulnerability. For Microsoft Windows 10 versions prior to 10.0.14393.5427, update to a version that contains the fix for this vulnerability. For Microsoft Windows 10 versions prior to 10.0.17763.3532, update to a version that contains the fix for this vulnerability. For Microsoft Windows 10 versions prior to 10.0.19042.2130, update to a version that contains the fix for this vulnerability. For Microsoft Windows 10 versions prior to 10.0.19043.2130, update to a version that contains the fix for this vulnerability. As a temporary workaround, consider disabling the Windows Print Spooler service to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2022-06785

CVE-2022-38028

Affected Products

Windows

Windows 10

Windows Print Spooler

References · 106

• https://nvd.nist.gov/vuln/detail/CVE-2022-38028 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38028 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-38028 · Vendor Advisory
• https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38028 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06785 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38028 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38028 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38028 · Vendor Advisory
• https://twitter.com/DecipherSec/status/1782752056836567192 · Twitter Post
• https://twitter.com/TGazdowski/status/1786457213118411176 · Twitter Post
• https://twitter.com/transilienceai/status/1797633684100542564 · Twitter Post
• https://twitter.com/transilienceai/status/1804880131019653512 · Twitter Post
• https://twitter.com/samilaiho/status/1782742499284455624 · Twitter Post
• https://t.me/cvenotify/77840 · Telegram Post
• https://t.me/pentestingnews/46192 · Telegram Post