{"id":"CVE-2022-41033","published":"2022-10-11T19:15:20Z","modified":"2026-06-17T05:02:27Z","title":"Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows COM+ Event System Service","tier":"core","eol":null,"description":{"text":"Windows COM+ Event System Service Elevation of Privilege Vulnerability","provenance":"source","from":"NVD"},"summary":{"text":"The Windows COM+ Event System Service in Microsoft Windows contains a privilege escalation flaw classified as type confusion, where a resource is accessed using an incompatible type. A local attacker holding low-privileged credentials, with no user interaction required, can exploit it to gain elevated privileges on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:28Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01886,"percentile":0.79517,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-10-11","dueDate":"2022-11-01","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41033;  https://nvd.nist.gov/vuln/detail/CVE-2022-41033","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-10-11","exploitedFirstSeen":"2022-10-11","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Oct","date":"2022-10-11"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2022-10-11"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-10-11"},{"url":"https://raw.githubusercontent.com/blackorbird/APT_REPORT/master/summary/2023/360_APT_Annual_Research_Report_2022.pdf","date":"2023-01-17"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41033","tags":["Patch","Vendor Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41033","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41033","tags":["US Government Resource"]}],"techniques":[{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2022-41033 is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows COM+ Event System Service, due to improper handling of privilege escalation scenarios. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves pairing the elevation of privilege vulnerability with other code-execution exploits, often through social engineering tactics such as enticing a user to open a malicious attachment or visit a harmful website. Once the vulnerability is exploited, attackers can manipulate system privileges to perform arbitrary actions with SYSTEM-level permissions. This allows them to achieve their objectives, such as installing programs, viewing or changing data, and creating new accounts with full user rights.","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Privilege Escalation","mappingType":"primary_impact","evidence":[],"comment":"CVE-2022-41033 is exploited by an attacker who has obtained access to the target system. The vulnerability lies in the Windows COM+ Event System Service, due to improper handling of privilege escalation scenarios. This vulnerability has been exploited by threat actors to gain elevated privileges on Windows systems. Attackers leveraged this flaw to execute arbitrary system commands, allowing them to manipulate system processes and potentially deploy additional malware or perform further malicious activities.\n\nThe exploit in question is actively being used in the wild, primarily in targeted attacks. It involves pairing the elevation of privilege vulnerability with other code-execution exploits, often through social engineering tactics such as enticing a user to open a malicious attachment or visit a harmful website. Once the vulnerability is exploited, attackers can manipulate system privileges to perform arbitrary actions with SYSTEM-level permissions. This allows them to achieve their objectives, such as installing programs, viewing or changing data, and creating new accounts with full user rights.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-44278","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44278","exploited":true,"exploitedSince":"2022-10-11","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1566.001"],"provenance":"source"},{"stage":"primary","techniques":["T1068"],"provenance":"source"}],"timeline":[{"date":"2022-10-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41033","provenance":"source"},{"date":"2022-10-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2022-Oct","provenance":"source"},{"date":"2022-10-11","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-10-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44278","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":56.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1482 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.9,"detail":"percentile 0.7952"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-843"}}