Now on Demand: Threat Detection and Incident Response (TDIR) Summit - All Sessions Available
Connect with us

Hi, what are you looking for?



CISA Warns of Windows Print Spooler Flaw After Microsoft Sees Russian Exploitation

CISA warns organizations of a two-year-old Windows Print Spooler vulnerability being exploited in the wild.

The US cybersecurity agency CISA on Tuesday added a two-year-old Windows Print Spooler flaw to its Known Exploited Vulnerabilities (KEV) catalog.

Tracked as CVE-2022-38028 (CVSS score of 7.8) and addressed as part of Microsoft’s October 2022 Patch Tuesday updates, the issue can be exploited to gain System privileges on a vulnerable machine.

“Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions,” CISA’s entry in the KEV catalog reads.

Per the Binding Operational Directive (BOD) 22-01, federal agencies have three weeks to identify within their environments any system vulnerable to CVE-2022-38028 and apply the available patches or remove the vulnerable products.

Although BOD 22-01 only applies to federal agencies, CISA urges all organizations to perform vulnerability assessments and address the security bugs in the KEV catalog as soon as possible.

CISA added CVE-2022-38028 to its must-patch list one day after Microsoft reported that a Russian cyberespionage group known as APT28 (tracked by the tech giant as Forest Blizzard) has been exploiting it in attacks targeting government, non-governmental, education, and transportation organizations.

As part of the observed attacks, the advanced persistent threat (APT) actor has been deploying a unique tool dubbed GooseEgg that can spawn other applications with System-level permissions, opening the door to remote code execution, backdoor deployment, and lateral movement.

According to Microsoft, APT28 was also observed exploiting other Print Spooler vulnerabilities for GooseEgg deployment, including CVE-2023-23397 and the PrintNightmare bugs tracked as CVE-2021-34527 and CVE-2021-1675.

Advertisement. Scroll to continue reading.

In the case of CVE-2022-38028, there were no reports of in-the-wild exploitation before Microsoft published its blog post on the GooseEgg attacks.

The main purpose of these attacks, the tech giant says, has been privilege escalation and credential and data harvesting.

Related: CISA: Second SharePoint Flaw Disclosed at Pwn2Own Exploited in Attacks

Related: Faster Patching Pace Validates CISA’s KEV Catalog Initiative

Related: CISA Warns of Windows Streaming Service Vulnerability Exploitation

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Wendy Zheng named as CFO and Joe Diamond as CMO at cyber asset management firm Axonius.

Intelligent document processing company ABBYY has hired Clayton C. Peddy as CISO.

Digital executive protection services provider BlackCloak has appointed Ryan Black as CISO.

More People On The Move

Expert Insights