CVE-2022-35756

Deeper analysis

Windows Kerberos Elevation of Privilege Vulnerability CVE-2022-35756 affects the Kerberos authentication component in Windows. The flaw carries a CVSS 3.1 score of 7.8 and is characterized by local attack vector, low attack complexity, no privileges required, and required user interaction, resulting in high impact to confidentiality, integrity, and availability.

An attacker with the ability to run code on a target system can exploit the issue to obtain elevated privileges. Because the vector is local and user interaction is needed, the typical scenario involves convincing a user to open a specially crafted file or perform another local action that triggers the Kerberos flaw and allows privilege escalation on that host.

Microsoft’s security advisory at msrc.microsoft.com details the affected Windows versions and provides patches that address the vulnerability. Administrators are advised to apply the updates through the standard Windows Update or Microsoft Update Catalog channels to remediate the issue. The associated EPSS score has remained in a narrow band between 0.1442 and a peak of 0.1497, indicating moderate but stable exploitation interest since disclosure.