CVE-2022-38045

Deeper analysis

CVE-2022-38045 is an elevation-of-privilege vulnerability in the Windows Server Service. The flaw received a CVSS 3.1 base score of 8.8 with an attack vector of network, low attack complexity, and low privileges required, allowing an authenticated remote attacker to obtain full control over confidentiality, integrity, and availability on the affected system.

An attacker who can reach the Server service over the network and authenticate with any valid account can exploit the issue to escalate privileges to SYSTEM level, thereby gaining the ability to install programs, view or modify data, or create new accounts with full administrative rights.

Microsoft has published security guidance and patches addressing the vulnerability through its Security Response Center at the referenced URLs. The EPSS score has remained flat at 0.1546 with no material increase after disclosure.