CVE-2022-24521Vulnerability
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 years ago
CISA KEVAdded 13 Apr 2022
Fix due 4 May 2022
Used by ransomware: knownCISA KEV catalogue
Fix due 4 May 2022
Used by ransomware: knownCISA KEV catalogue
EPSS7.1%
higher than 94% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 94% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies“The following example is of matches on CVE-2022-24521 where cmd.exe is started as SYSTEM:”
Indicators reported together
named in the same reports- process[.]pidin 1 report
- host.os[.]familyin 1 report
- hxxps://i.blackhat[.]com/USA-22/Thursday/us-22-Jin-The-Journey-Of-Hunting-ITW-Windows-LPE-0day-wp.pdfin 1 report
- i.blackhat[.]comin 1 report
- hxxps://googleprojectzero.github[.]io/0days-in-the-wild/rca.htmlin 1 report
- googleprojectzero.github[.]ioin 1 report
- hxxps://conference.hitb[.]org/hitbsecconf2023ams/session/hunting-windows-desktop-window-manager-bugs/in 1 report
- conference.hitb[.]orgin 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2023-2825, CVE-2023-36033, CVE-2022-41073
Thanks — we review every report.