CVE-2019-1069: Microsoft Task Scheduler link-following privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with known ransomware use and a public exploit, but exploitation requires prior local code execution, so it is a high-priority local privilege escalation rather than a remotely exploitable critical flaw.

What it is

The Windows Task Scheduler Service fails to properly validate certain file operations, allowing a link-following (CWE-59) condition during task handling. A local attacker with unprivileged code execution can abuse this to gain elevated privileges on the host. Because it is a local privilege escalation in a core Windows component, it is a useful post-compromise step for attackers and ransomware operators.

Impact

An attacker who already has unprivileged code execution can escalate to higher privileges on the victim system, typically SYSTEM or administrator level, enabling full control of the host.

Attack surface

Reached locally: the CVSS vector is AV:L/PR:L/UI:N, so the attacker needs existing low-privileged code execution on the machine and no user interaction. No network or remote vector is described.

Exploitation

CISA added it to KEV on 2022-03-15 with a 2022-04-05 remediation due date and flags known ransomware campaign use; EPSS 30-day probability is about 6.1 percent (93rd percentile). A public exploit reference exists (0patch blog), confirming real-world exploitation.

What to do

• Apply the Microsoft security update for CVE-2019-1069 to all affected Windows 10 and Windows Server builds listed in the advisory.
• Prioritize patching on systems where untrusted users or processes can run code, since exploitation requires only local low-privileged access.
• Restrict and monitor who can create or modify scheduled tasks and task-related files/directories.
• Where patching is delayed, apply the vendor-recommended workarounds and limit interactive/local code execution paths for non-admin users.

Detection

• Monitor for suspicious scheduled task creation or modification events (e.g., Windows Task Scheduler operational logs, event IDs 106/140/200) around privilege escalation attempts.
• Alert on processes creating or following links/junctions in Task Scheduler-related paths, especially from low-privileged contexts.
• Correlate local privilege escalation behavior with post-exploitation activity such as new service creation or token manipulation.
• Hunt for known exploit artifacts or tooling associated with Task Scheduler privilege escalation on endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.