Loading vulnerability…
CVE-2022-38028 is a local elevation-of-privilege vulnerability in the Windows Print Spooler service. Public reporting indicates the flaw can be abused by modifying a JavaScript constraints file used by spooler-related components and triggering execution through the spooler so attacker-controlled code runs in the context of the Print Spooler service with SYSTEM privileges. Microsoft-linked analysis of in-the-wild exploitation described abuse involving a rogue protocol handler and execution during spooler processing, resulting in SYSTEM-level code execution from a low-privileged context. The vulnerability affects multiple supported Windows client and server releases and was patched by Microsoft in October 2022.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability exploited post-compromise to obtain credentials, discussed in connection with the GooseEgg tool and Forest Blizzard/APT28 activity.
A Windows Print Spooler privilege escalation vulnerability weaponized by APT28 via the GooseEgg tool to gain SYSTEM-level execution.
A Windows privilege-escalation vulnerability referenced as a technique to detect (rule tuning/false-positive reduction), without additional technical detail in this digest.
A Windows Print Spooler privilege escalation vulnerability exploited by Forest Blizzard using the GooseEgg tool to gain elevated privileges, steal credentials, and enable further compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.