CVE-2022-30165

Deeper analysis

CVE-2022-30165 is an elevation of privilege vulnerability affecting the Windows Kerberos component. It carries a CVSS 3.1 score of 8.8 with a network attack vector, low complexity, and low privileges required, allowing an unauthenticated or low-privileged remote actor to impact confidentiality, integrity, and availability on affected Windows systems.

An attacker who can reach the Kerberos service can leverage the flaw to escalate privileges and obtain full control of the target host. The vulnerability requires no user interaction and operates across security boundaries, enabling a compromised low-privileged account to achieve system-level access.

Microsoft security advisories at msrc.microsoft.com and portal.msrc.microsoft.com direct administrators to apply the patches released for this CVE; the guidance emphasizes installing the updates in the standard monthly cycle to close the redirected logon buffer issue.

The associated EPSS values have stayed within a narrow band between 0.0741 and a peak of 0.0790, showing no material post-disclosure climb that would indicate emerging exploitation interest.