Windows Print Spooler vulnerabilities were widely targeted in Kaspersky’s telemetry from July 2021 through April 2022, but that historical increase is not evidence that exploitation is rising today. Kaspersky recorded about 65,000 detections in that period, including roughly 31,000 from January through April 2022; these are detections, not a count of unique victims. Microsoft’s 2024 reporting separately confirms that a Russian state-linked actor used one spooler vulnerability in post-compromise operations. For administrators, the practical response is to patch Windows, disable the service on systems that do not print, and restrict printer-driver installation where printing is required.
What the exploitation figures do—and do not—show
On May 10, 2022, Kaspersky reported approximately 65,000 detections of attacks exploiting Windows Print Spooler vulnerabilities between July 2021 and April 2022. About 31,000 detections fell in January–April 2022. Kaspersky also said nearly a quarter of detections over the full period came from Italy; Austria, France, and Slovenia had the most detections in the final four months. These are vendor telemetry observations, not a representative census of global activity, and the report does not establish how many unique attacks, devices, or organizations they represent. Kaspersky’s May 2022 report describes the finding as a period-specific increase.
That dataset ends in April 2022. It cannot establish whether exploitation is increasing in 2026. A separate Microsoft report published April 22, 2024, documents sustained use of a particular spooler-related vulnerability, but does not quantify a current, broader trend.
Which Windows Print Spooler vulnerabilities are involved?
“Print Spooler vulnerability” is not one flaw. PrintNightmare refers to CVE-2021-34527 and CVE-2021-1675, while Microsoft’s later GooseEgg reporting concerns CVE-2022-38028. Their exploitation details and fixes should not be conflated.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- BEST FOR SMALL BUSINESSES – Engineered for extraordinary productivity, the Brother DCP-L2640DW Monochrome (Black & White) 3-in-1 combines laser printer, scanner, copier in one compact footprint and delivers high-quality black & white prints
- FAST PRINTER WITH EFFICIENT SCANNING – Produces documents quickly with print speeds up to 36 ppm(2) and scan speeds up to 23.6/7.9 ipm(3) (black/color). A 50-page auto document feeder(4) allows for convenient, time saving multi-page scanning and copying
- FLEXIBLE CONNECTION OPTIONS – Easily navigate the changing demands of your business with secure multi-device connectivity via built-in dual-band wireless (2.4GHz / 5GHz) and Ethernet. Or connect locally to a single computer via USB interface
- BROTHER MOBILE CONNECT APP – Print, scan, and manage your wireless printer anytime, from almost anywhere from your mobile device. Order Brother Genuine Supplies, track toner usage, and complete more work on-the-go(5)
- CHOOSE BROTHER GENUINE TONER – When it’s time to replace your toner, be sure to choose Brother Genuine TN830 or TN830XL replacement toner. And with Refresh EZ Print Subscription Service, you’ll never worry about running out of toner again and you’ll enjoy savings of up to 50%(6) on Brother Genuine Toner. Get started with Refresh today with a Free Trial(1)
- CVE-2021-34527 (PrintNightmare): Microsoft’s KB5005010 guidance says the July 6, 2021 out-of-band update or a later update includes protections. See Microsoft KB5005010.
- CVE-2021-1675: This is a separate Print Spooler CVE. Do not assume that a detail documented for CVE-2021-34527 applies identically to it.
- CVE-2022-38028: Microsoft says the Forest Blizzard actor used its GooseEgg tool against this vulnerability to elevate privileges after obtaining access to a target device. Microsoft advises applying the security update for the CVE. The report does not describe it as an unauthenticated, internet-facing initial-access method. Microsoft’s GooseEgg analysis says it observed use since at least June 2020, possibly as early as April 2019.
Why the Print Spooler matters to security
The Print Spooler manages print jobs and data conversion. Microsoft explains that it runs with SYSTEM privileges, is widely accessible to standard users, and has historically loaded third-party driver code on demand. Old or unsupported drivers can complicate remediation because fixing a driver vulnerability may depend on its third-party maker. Microsoft’s protected print mode article says print bugs accounted for 9% of cases reported to MSRC over the “past three years”; the article does not specify a calendar range for that figure. Microsoft: Windows protected print mode.
What GooseEgg exploitation looked like
Microsoft describes GooseEgg as a post-compromise tool: the actor already had access to the target device. It used the tool to modify a JavaScript constraints file and run it with SYSTEM-level permissions. The resulting elevated access could support credential theft and other follow-on objectives, including persistence and lateral movement. This is evidence that a spooler flaw remained useful in real intrusions; it does not mean every spooler vulnerability works the same way or provides an attacker with initial access.
Rank #2
- BEST FOR HOMES & HOME OFFICES – Engineered for consistent, premium print quality, the Brother HL-L2405W Monochrome (Black & White) Laser Printer delivers sharp, crisp prints at an affordable price. Prints one-sided documents at speeds up to 30ppm(2)
- COMPACT, CONNECTED PRINTER – Flexible connection options make this an ideal printer for home use and at-home offices. Securely connect to multiple devices with built-in dual-band wireless (2.4GHz/5GHz) or locally to a single computer via USB interface
- BROTHER MOBILE CONNECT APP – Manage your printer remotely and print from your mobile device anytime, from almost anywhere. Order Brother Genuine Supplies, track toner usage, and complete more work on-the-go(3)
- VERSATILE PAPER HANDLING – Enjoy seamless, reliable everyday printing with the 250-sheet paper tray(4) and a manual feed slot that enables printing on envelopes and specialty pape
- BROTHER IS AT YOUR SIDE – Backed by Brother with a 1-year limited warranty and free online, call, or live chat support for the life of your printer
How to reduce Print Spooler risk
For domain controllers and devices that do not print
If a system has no printing requirement, disabling the Print Spooler removes an unnecessary service from its attack surface. CISA’s June 30, 2021 PrintNightmare alert specifically recommends disabling it on domain controllers and systems that do not print. That is scoped guidance, not a blanket instruction for a print server or a workstation that must print. See CISA’s alert.
For Windows systems that must print
- Install current Windows security updates. Microsoft recommends current updates; apply the relevant fixes for the specific CVEs in your environment. For CVE-2021-34527, KB5005010 identifies the July 6, 2021 out-of-band update or later updates as containing protections. For CVE-2022-38028, follow Microsoft’s instruction to apply its security update.
- Require administrator approval for driver installation. Microsoft’s Point and Print guidance recommends setting new and existing driver installation behavior to “Show warning and elevation prompt,” and limiting printer-driver installation to administrators. The August 10, 2021 MSRC change made administrator privileges the default for Point and Print driver installation on supported Windows versions receiving that update. Avoid disabling this mitigation: Microsoft warns that doing so exposes the environment to publicly known Print Spooler vulnerabilities. See MSRC’s Point and Print guidance and KB5005010.
- Assess driverless printing where practical. Microsoft presents Internet Printing Protocol (IPP)-based driverless printing and Windows protected print mode as ways to reduce reliance on third-party drivers. Protected print mode disables third-party driver loading, restricts spooler configuration, and runs some print tasks with lower privileges. It supports Mopria-certified printers; check printer compatibility and operational requirements before changing a fleet.
- Use detection as a supporting control. Microsoft says Defender Antivirus detects the specific GooseEgg capability as HackTool:Win64/GooseEgg. Detection does not replace updates or configuration controls.
Choosing controls for a print environment
| Environment | Practical priority | Key qualification |
|---|---|---|
| Domain controller or other device with no printing requirement | Disable Print Spooler, as CISA recommends for these systems. | Confirm that no required workflow depends on the service. |
| Endpoint or server that must print | Keep Windows updated and constrain driver installation to administrators with warning and elevation prompts. | Microsoft’s Point and Print defaults apply to supported Windows versions receiving the relevant update. |
| Fleet considering driverless printing | Assess IPP and Windows protected print mode. | Microsoft identifies Mopria-certified printer support; compatibility with every legacy printer is not established. |
The right choice depends on whether a device needs to print, whether it hosts a spooler or print-server role, whether it is updated, and whether its printers support the intended driverless configuration. The cited guidance does not provide a universal compatibility or cost comparison.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- FROM AMERICA'S MOST TRUSTED PRINTER BRAND – Perfect for small teams printing professional-quality black & white documents and reports. Perfect for 1-3 people
- WORLD'S SMALLEST LASER IN ITS CLASS – Precision laser printing that fits anywhere
- FAST PRINT SPEEDS – Up to 21 black-and-white pages per minute single-sided
- WIRELESS WITH SELF-RESET – Helps you stay connected
- PRINT FROM ANY DEVICE – Wireless printing from any mobile device, PC or tablet. Works with Microsoft, Mac, AirPrint, Android, Chromebook and more
Rank #4
- BEST FOR HOME OFFICES & SMALL TEAMS – Engineered for consistent, premium print quality, the Brother HL-L2460DW Monochrome (Black & White) Laser Printer produces documents that are clear, crisp, and easy to review and share, all at an affordable price
- COMPACT, CONNECTED, EXCEPTIONALLY EFFICIENT– Connect with built-in dual-band wireless (2.4GHz/5GHz), Ethernet, or to a single computer via USB interface. Prints at speeds up to 36ppm(2), plus automatic duplex printing saves time and reduces paper waste
- BROTHER MOBILE CONNECT APP – Manage your wireless printer remotely and print from your mobile device anytime, from almost anywhere. Order Brother Genuine Supplies, track toner usage, and complete more work on-the-go(3)
- VERSATILE PAPER HANDLING – Tackle high-volume black & white printing with the 250-sheet capacity paper tray.(4) The manual feed slot enables printing on envelopes and specialty paper
- BROTHER IS AT YOUR SIDE – Backed by Brother with a 1-year limited warranty and free online, call, or live chat support for the life of your printer
Rank #3
- FAST PRINT SPEEDS: Print up to 19 pages per minute.
- COMPACT DESIGN: Space-saving, compact design fits anywhere in your home, school or small office.
- WIRELESS CONNECTIVITY: Print from almost anywhere in your workspace using your compatible mobile device.
- PAPER CAPACITY: Up to 150 sheets.
- SUSTAINABILITY: Uses less than 2 watts in Energy Saver mode.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
