CVE-2019-0543: Windows improper authentication handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8 with local low-privilege access, confirmed in-the-wild exploitation and ransomware association, and a wide affected product set.

What it is

Windows improperly handles authentication requests, allowing a local user to elevate privileges. The flaw affects a broad set of Windows client and server releases and is tracked in CISA's Known Exploited Vulnerabilities catalog, so it matters for both unpatched endpoints and servers.

Impact

An attacker with a foothold on a host gains elevated privileges, typically SYSTEM, enabling full control of the machine and lateral movement.

Attack surface

Reached locally on the target system; the CVSS vector shows local access with low privileges and no user interaction, so no remote path or victim action is required.

Exploitation

CISA KEV lists it as exploited in the wild and associated with known ransomware campaigns; a public Exploit-DB entry exists. EPSS 30-day probability is about 4.7 percent (91st percentile).

What to do

• Apply the Microsoft security update referenced in the vendor advisory on all affected Windows versions.
• Prioritize patching internet-facing and privileged-access systems, and any host where a low-privileged user already has a foothold.
• Restrict local logon and interactive access to trusted users to reduce the pool of accounts that can trigger the flaw.
• Monitor for and remove unpatched legacy systems (Windows 7, Server 2008/2008 R2, RT 8.1) that cannot receive updates.
• Verify patch compliance against the KEV due date and track exceptions.

Detection

• Alert on unexpected process token elevation or SYSTEM-level process creation from non-service parent processes.
• Monitor Windows security event logs for anomalous authentication or logon activity on affected hosts.
• Hunt for known exploit artifacts or tooling tied to public exploit code for this CVE.
• Correlate local privilege escalation indicators with ransomware precursor behavior on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.