CVE-2022-26904

Deeper analysis

CVE-2022-26904 is an elevation-of-privilege vulnerability in the Windows User Profile Service stemming from a race condition (CWE-362). The flaw affects multiple versions of Windows and carries a CVSS 3.1 score of 7.0, reflecting local attack vector, high attack complexity, low privileges required, and high impact on confidentiality, integrity, and availability.

A local attacker with a low-privileged account can exploit the race condition to obtain SYSTEM-level privileges on an affected system. Successful exploitation grants the attacker full control over the target machine, enabling arbitrary code execution, credential theft, and persistence.

Microsoft’s security update guide recommends installing the patches released on April 12, 2022, which address the underlying race condition in the User Profile Service. The vulnerability is also listed in CISA’s Known Exploited Vulnerabilities catalog, confirming that federal agencies must apply mitigations according to the published timelines.

EPSS scores for the CVE rose from low values after disclosure to a peak of 0.2831 in December 2025 before receding to the current 0.2300, indicating renewed exploitation interest well after the initial release.