Microsoft · Windows COM+ Event System Service

CVE-2022-41033

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Exploited in attacks High 7.8 Attack chance: 1.9%

What it is

Windows COM+ Event System Service Elevation of Privilege Vulnerability

CISA: Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: November 1, 2022

msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41033

Added to the CISA list: October 11, 2022
Published: October 11, 2022
Severity: High 7.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 1.9% in the top 20.6% of all known vulnerabilities
Weakness: CWE-843
More details: NVD · CVE.org · CISA

More exploited flaws from Microsoft

Added	Vulnerability	Product	Severity	Attack chance
Oct 13, 2026	Command InjectionCVE-2026-96951	Windows	High 8.8	9.8%
Sep 25, 2026	Code InjectionCVE-2026-65660	SharePoint	High 8.8	8.2%
Sep 8, 2026	Link FollowingCVE-2026-81963	Windows	High 7.8	0.4%
Sep 8, 2026	Heap-Based Buffer OverflowCVE-2026-85880	Windows	High 7.8	0.4%
Aug 26, 2026	Remote Code ExecutionCVE-2019-1068	SQL Server	High 8.8	57%
Aug 18, 2026	Double FreeCVE-2026-33824	Internet Key Exchange (IKE) Service Extensions	Critical 9.8	77%
Aug 18, 2026	Weak AuthenticationCVE-2026-55040	SharePoint	Critical 9.1	70%
Aug 11, 2026	Windows Ancillary Function Driver for WinSock Use-After-FreeCVE-2026-68820	Windows Ancillary Function Driver for WinSock	High 7.0	0.3%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.