A newly disclosed vulnerability in the Windows Print Spooler service allows unauthenticated remote code execution on unpatched systems. Here's the full breakdown and your immediate action checklist.
Active exploitation confirmed. This vulnerability is being actively exploited in the wild. If you have not applied the March 2025 Patch Tuesday update, treat this as urgent. Do not wait for a scheduled maintenance window.
CVE-2025-0842 is a critical unauthenticated remote code execution (RCE) flaw in the Windows Print Spooler service (spoolsv.exe). It affects every supported version of Windows 10, Windows 11, and Windows Server 2016 through 2022, and it carries a CVSS score of 9.8, which is about as high as it gets.
The Print Spooler service manages the printing queue on Windows machines. It runs as SYSTEM, the highest privilege level on a Windows host. That combination of broad attack surface and SYSTEM-level execution is exactly what makes this so dangerous.
The vulnerability was responsibly disclosed to Microsoft by independent security researchers and has since been observed being exploited in targeted attacks. Microsoft confirmed active exploitation in their Patch Tuesday advisory, which means there are real threat actors actively hunting for unpatched machines right now.
The flaw lives in the way the Print Spooler processes certain crafted print job requests. An attacker with network access, no credentials required, can send a specially constructed request to the spooler service that triggers a memory corruption condition. From there, they can execute arbitrary code in the context of SYSTEM.
If that sounds familiar, it should. The attack surface is nearly identical to PrintNightmare (CVE-2021-1675), which made global headlines in 2021. Microsoft patched PrintNightmare, but the Print Spooler's architecture creates a recurring pattern of exploitable flaws. Researchers have now found another path through the same service.
Why domain-joined machines are especially exposed: Once an attacker achieves SYSTEM on a single domain-joined host, lateral movement across the network becomes straightforward. They can extract credentials from memory, move to other machines, and escalate toward your domain controller, all without triggering obvious alerts if you lack endpoint detection tooling.
The word "unauthenticated" is the most important part of this CVE. Many network attacks require the attacker to first obtain a valid username and password, even a low-privileged one. This vulnerability requires nothing. Any machine on the network that can reach an exposed spooler port is a viable target.
The default Windows firewall does block some inbound spooler traffic on consumer systems, but corporate networks with internal firewall rules, shared subnets, and permissive east-west traffic policies frequently expose spooler ports to internal hosts. A single compromised device inside your perimeter (say, an employee's laptop infected via phishing), becomes a launchpad for this attack.
If you run Windows in your business, the honest answer is: probably you. The Print Spooler service is enabled by default on all Windows installations. Most businesses have never turned it off, even on machines that do not have a printer attached, because various software installers and Windows components depend on it silently.
You are most at risk if any of the following apply:
Work through these in order. Steps 1 and 2 are diagnostic; step 3 onward are your mitigations.
Get-Service -Name Spooler. If the status is Running, you are exposed until patched or disabled.Stop-Service -Name Spooler; Set-Service -Name Spooler -StartupType Disabled. This removes the attack surface entirely.lsass.exe. These will not prevent the initial exploit but limit what an attacker can do post-compromise.spoolsv.exe, any process like cmd.exe, powershell.exe, or rundll32.exe appearing as a child of the spooler is a serious red flag.If you have centralised logging (whether through Windows Event Forwarding, a SIEM, or your MSP's monitoring platform), these are the specific indicators to search for:
spoolsv.exe as the parent process. Any child process spawned by the spooler outside of printing activity is anomalous.\\pipe\spoolss named pipe from an unexpected host or user account.spoolsv.exe has recently restartedNo EDR? Windows Defender with the latest definitions provides some behavioural detection for PrintNightmare-style exploitation. Make sure it is running and up to date as an absolute baseline. But it is not a substitute for purpose-built endpoint detection tooling in a business environment.
Microsoft released a fix for CVE-2025-0842 as part of the March 2025 Patch Tuesday cumulative update rollout. The relevant KB numbers for the most common OS versions are:
If your machines are configured to receive updates automatically, they may already be patched, but verify. Automatic updates do not always complete on schedule, particularly on machines that are rarely restarted or have conflicting update policies. Pull a compliance report from your patch management tool or check winver and cross-reference the build number against Microsoft's published update history.
PrintNightmare in 2021 caught the industry off guard because organisations had no idea Print Spooler was even running on most of their servers. CVE-2025-0842 is a reminder that this lesson has not been learned widely enough. Services you do not actively use are still attack surface. The Print Spooler should be disabled on every machine that does not need it, full stop.
More broadly, this CVE illustrates why patch management is not optional and why "we'll get to it next month" is not a risk posture, it is an acceptance of breach. The gap between patch release and active exploitation is measured in days, sometimes hours. Organisations without a systematic, monitored patch process will always be behind the curve.