CVE-2019-0841: Windows AppX Deployment Service hard link privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8 with local low-privilege access, KEV listing with known ransomware use, and very high EPSS make this a high-priority patch despite requiring local access.

What it is

Windows AppX Deployment Service (AppXSVC) mishandles hard links (CWE-59), letting a local user redirect privileged file operations. A low-privileged attacker on an affected Windows 10 or Windows Server host can elevate to SYSTEM, which matters because this flaw is in CISA's Known Exploited Vulnerabilities catalog and has been linked to ransomware campaigns.

Impact

An attacker gains full administrative or SYSTEM-level control of the host, enabling credential theft, persistence, and further lateral movement. Because it is a local elevation flaw, it is typically chained after initial access to escalate privileges.

Attack surface

Reached locally on the host; the CVSS vector AV:L/PR:L/UI:N indicates a low-privileged local user is required and no user interaction is needed. No network or remote vector is described.

Exploitation

Listed in CISA KEV (added 2022-03-15) with known ransomware campaign use, and public exploit references exist (Exploit-DB 46683, Packet Storm). EPSS 30-day probability is 0.414 (98.6th percentile), indicating high likelihood of exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2019-0841 on all affected Windows 10 and Windows Server builds.
• Prioritize patching hosts that are internet-facing or already flagged as compromised, given KEV status and ransomware association.
• Restrict local interactive logon and administrative rights to reduce the pool of accounts that can trigger the flaw.
• Monitor for and block unauthorized hard link creation to privileged locations where feasible.
• Verify patch coverage against the listed products (Windows 10 1703/1709/1803/1809, Windows Server 2016/2019).

Detection

• Alert on hard link creation targeting privileged system paths or service-writable directories.
• Monitor AppXSVC-related process activity and unexpected writes to protected locations.
• Hunt for post-exploitation behavior consistent with local privilege escalation to SYSTEM, such as new services or token manipulation.
• Correlate endpoint telemetry for known public exploit artifacts tied to AppXSVC hard link abuse.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.