Unpatched 'PhantomRPC' Flaw in Windows Enables Privilege Escalation

Why It Matters

Without a fix, organizations running Windows servers remain exposed to a privilege‑escalation path that can give attackers full system control, heightening the risk of data breaches and ransomware.

Key Takeaways

• PhantomRPC exploits RPC endpoint registration when legitimate service is stopped
• Attackers can gain SYSTEM token from low‑privilege Network Service accounts
• Microsoft rated flaw moderate, no CVE, and has not issued a patch
• Kaspersky recommends ETW monitoring, keeping RPC endpoints active, limiting SeImpersonatePrivilege
• Vulnerability affects Windows Server 2022/2025 and likely older versions

Pulse Analysis

The Remote Procedure Call framework underpins inter‑process communication across Windows environments, but its design assumes that services will be continuously available. PhantomRPC turns this assumption against defenders by allowing any process to bind to an unused RPC endpoint and masquerade as a legitimate service. When a privileged client connects, the malicious server can impersonate that client and elevate its token to SYSTEM, mirroring the impact of historic flaws like PrintNightmare and CVE‑2021‑1675. This architectural weakness is especially concerning because it does not rely on a specific code bug but on the fundamental way RPC handles unavailable services.

Microsoft’s response has been unusually restrained. After receiving a detailed 10‑page report, the company labeled the issue “moderate severity,” citing the prerequisite that the attacker already possess SeImpersonatePrivilege. Consequently, no CVE identifier was assigned and no patch has been released, leaving the flaw untracked in Microsoft’s vulnerability database. This stance diverges from the company’s typical rapid‑patch cadence for privilege‑escalation bugs and raises questions about risk assessment criteria, especially as the exploit works on the latest Windows Server releases and likely older versions.

In the absence of an official fix, defenders must rely on detection and hardening. Event Tracing for Windows (ETW) can surface anomalous RPC connection attempts to non‑existent endpoints, providing an early warning sign. Administrators should also ensure that legitimate RPC services remain running to reduce the attack surface and audit the assignment of SeImpersonatePrivilege, limiting it to essential system components only. These steps, while not a substitute for a patch, help mitigate the immediate threat and underscore the need for continued vendor engagement on architectural security flaws.