Is CVE-2022-24139 actively exploited?

No active exploitation of CVE-2022-24139 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-24139 be exploited remotely?

No. CVE-2022-24139 requires local access to exploit.

What is the CVSS score of CVE-2022-24139?

CVE-2022-24139 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2022-24139

HIGH

CVE-2022-24139

CWE-668Published: July 6, 2022· Updated: Jul 9, 2026

7.8

CVSS v3.1

Official Description

In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -> SYSTEM or from Local ADMIN-> Domain ADMIN depending on the user and named pipe that is used.

NVD Source

Technical Analysis

CVE-2022-24139 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.