KB5004946: Windows Server 2019 / 2022 Out-of-band Security Update (July 2021)

Any authenticated domain account — including low-privileged service accounts or compromised user accounts — can exploit this to gain SYSTEM-level code execution on any Windows Server running the Print Spooler, including Domain Controllers. An attacker who owns one account can own every server in the domain.

The Windows Print Spooler service runs by default on all Windows Servers. A flaw in how it handles certain print driver installation operations allows an authenticated user to load a malicious DLL with SYSTEM privileges. No local access is required — the attack works over the network from any domain-joined machine.

Probably yes if any of these apply:

Ransomware groups including Magniber and Vice Society weaponised PrintNightmare within days of public PoC release. In one documented incident, attackers moved from a single phishing compromise to full domain takeover in under 4 hours using PrintNightmare to escalate privileges on each server they reached. Microsoft released KB5004946 as an emergency out-of-band patch on July 6, 2021.