CVE-2019-1129: Windows AppXSVC hard link handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityConfirmed in-the-wild exploitation with ransomware use and a full high-integrity compromise from a local foothold, though it requires prior local access.

What it is

Windows AppX Deployment Service (AppXSVC) mishandles hard links, a link-following flaw (CWE-59) that lets a local user escalate privileges. It affects multiple Windows 10 and Windows Server builds, and Microsoft patched it in July 2019. Because it yields full system compromise from an unprivileged local session, it remains a serious post-exploitation tool.

Impact

An attacker who already has a low-privileged local account can gain elevated privileges, typically SYSTEM, on the affected host. That opens the door to credential theft, persistence, and disabling of security controls.

Attack surface

Reached locally: the CVSS vector is AV:L with PR:L and UI:N, so the attacker needs an existing low-privileged logon but no user interaction. No network or remote vector is described.

Exploitation

CISA added it to the KEV catalog on 2022-03-15 with known ransomware campaign use, so exploitation in the wild is confirmed. EPSS is modest (0.01782, 77th percentile), consistent with a local privilege escalation used after initial access rather than mass scanning.

What to do

• Apply the Microsoft security update for CVE-2019-1129 to all affected Windows 10 and Windows Server builds.
• Prioritize patching on endpoints and servers where untrusted users or remote code execution footholds are likely.
• Restrict local logon and interactive access to only necessary accounts to reduce the pool of users who can trigger the flaw.
• Monitor for and remove unnecessary hard links in user-writable locations that could be abused for link-following attacks.

Detection

• Alert on unexpected hard link creation in user-writable directories, especially paths tied to AppX or service-writable locations.
• Monitor process creation where AppXSVC or related service processes spawn unexpected child processes or load unusual modules.
• Correlate local privilege escalation indicators, such as new SYSTEM-level processes from non-admin sessions, with AppX activity.
• Review host telemetry for known post-exploitation behavior following privilege escalation, including credential dumping and service creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.