CVE-2022-35841
Published: 13 September 2022
Summary
CVE-2022-35841 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Enterprise App Management Service contains a remote code execution vulnerability tracked as CVE-2022-35841. The flaw affects the Windows component responsible for enterprise application management and carries a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, and low required privileges.
An authenticated attacker with low privileges can send specially crafted requests over the network to execute arbitrary code with high impact on confidentiality, integrity, and availability. No user interaction is required, allowing the attacker to fully compromise the affected system.
Microsoft has published remediation guidance in its Security Response Center update guide at the referenced advisory URL, directing administrators to apply the available security updates for the affected Windows versions.
The associated EPSS score stands at 0.2618 with no recorded increase from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38714
Vulnerability details
Windows Enterprise App Management Service Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.