CISA has ordered agencies to patch an actively exploited, zero-day local privilege escalation vulnerability for Windows by no later than August 2, 2022. The flaw, tracked as CVE-2022-22047, impacts the Windows client-server runtime subsystem (CSRSS), and if exploited would allow attackers to elevate their local privileges to SYSTEM. Although many cybersecurity researchers believe that this flaw should have been rated as critical due to it being actively exploited, it has been given a CVSS score of 7.8 and rated as “Important.” This is due to the fact that it is only a local privilege escalation, and the attackers would have to pair it with a remote code execution vulnerability for it to work. At this time, the vulnerability is still being analyzed so the technical information is limited, but CISA has added it to their catalog of Known Exploited Vulnerabilities (KEV). It is now officially a part of the binding operational directive (BOD 22-01), issued in November 2021, stating that all Federal Civilian Executive Branch (FCEB) agencies are required by law to defend and secure their networks against known vulnerabilities. This flaw is one (1) of 84 patched vulnerabilities for this update, and details can be found in the below-linked July 2022 Security Update from Microsoft. To prevent exploitation, CTIX analysts recommend that Windows users ensure that they are using the most recent version of Windows.