Vulnerability record · CVE-2019-1064 · published 12 June 2019
CVE-2019-1064: Windows AppX Deployment Service hard link privilege escalation
Microsoft · Windows 10 1607
Windows AppX Deployment Service (AppXSVC) improperly handles hard links, allowing a logged-on attacker to run code in an elevated context. Because the service runs with high privileges, successful exploitation lets an attacker install programs and view, change, or delete data on the affected system.
Description
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.8 with confirmed exploitation in the wild and known ransomware campaign use, though it requires local access and low privileges.
What it is
Windows AppX Deployment Service (AppXSVC) improperly handles hard links, allowing a logged-on attacker to run code in an elevated context. Because the service runs with high privileges, successful exploitation lets an attacker install programs and view, change, or delete data on the affected system.
Impact
An attacker gains elevated execution on the host, enabling installation of programs and modification or deletion of data. This is a local privilege escalation, not remote code execution.
Attack surface
Reached locally: the attacker must first log on to the system and then run a specially crafted application. No user interaction beyond that logon is required, and the CVSS vector (AV:L/PR:L/UI:N) confirms local access with low privileges.
Exploitation
CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-15 with a 2022-04-05 remediation due date and flags known ransomware campaign use. EPSS 30-day probability is 0.06886 (93.7th percentile), and references are patch/vendor advisory plus the CISA KEV entry.
What to do
- Apply the Microsoft security update for CVE-2019-1064 on all affected Windows 10 and Windows Server builds.
- Prioritize patching on systems where standard users have local logon, since exploitation requires only low-privilege access.
- Track remediation against the CISA KEV due date and verify patch installation rather than relying on scan-only evidence.
- Restrict local logon and interactive access to only users who need it to reduce the exposed attack surface.
Detection
- Monitor for unexpected elevation of processes spawned from user-writable locations, especially those interacting with AppXSVC.
- Alert on hard link creation or manipulation targeting AppX/AppXSVC-related paths by non-administrative users.
- Correlate local logon events with subsequent high-integrity process creation on unpatched hosts.
- Review AppXSVC service activity for anomalies around package deployment operations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2019-1064 to the Known Exploited Vulnerabilities catalog on 15 March 2022 as "Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 5 April 2022.
Affected products
11 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
Windows 10 1607 Microsoft
Windows 10 1703 Microsoft
Windows 10 1709 Microsoft
Windows 10 1803 Microsoft
Windows 10 1809 Microsoft
Windows 10 1903 Microsoft
Windows Server 1709 Microsoft
Windows Server 1803 Microsoft
Windows Server 1903 Microsoft
Windows Server 2016 Microsoft
Windows Server 2019 Microsoft
References
| Link | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1064 | PatchVendor Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1064 | PatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1064 | US Government Resource |
Track CVE-2019-1064 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-1064), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
