CVE-2019-1130: Windows AppX Deployment Service hard link handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable elevation of privilege flaw with a CVSS of 7.8, listed in CISA KEV with known ransomware use, though it requires an existing foothold.

What it is

Windows AppX Deployment Service (AppXSVC) improperly handles hard links, allowing a local attacker to elevate privileges. The flaw is a link-following issue (CWE-59) that affects a broad set of Windows 10, Windows 8.1, and Windows Server releases. Because it enables full compromise of confidentiality, integrity, and availability, it is a serious post-compromise escalation primitive.

Impact

An attacker who already has a foothold on the host can gain elevated privileges, typically SYSTEM, allowing full control of the machine. This can be used to disable defenses, move laterally, or deploy ransomware.

Attack surface

The attack is local (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N). The attacker must already be able to run code on the target system and then abuses AppXSVC's hard link handling.

Exploitation

CVE-2019-1130 is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware campaign use, and EPSS shows a 30-day probability of 0.02284 (82nd percentile). The vendor reference is tagged as a patch advisory.

What to do

• Apply the Microsoft security update for CVE-2019-1130 on all affected Windows 10, Windows 8.1, Windows RT 8.1, and Windows Server versions.
• Prioritize patching systems where local low-privileged code execution is plausible, such as multi-user endpoints and terminal servers.
• Restrict local logon and code execution rights to reduce the ability of an attacker to reach the vulnerable service.
• Monitor for and block known ransomware tooling and post-exploitation behavior on unpatched hosts.
• Verify patch compliance against CISA KEV due date requirements for internet-facing and high-value assets.

Detection

• Monitor for unexpected creation or manipulation of hard links in user-writable locations, especially paths associated with AppX or WindowsApps.
• Alert on processes spawning from AppXSVC or svchost hosting AppXSVC that then execute with SYSTEM integrity.
• Correlate local privilege escalation events (for example, token or integrity level changes) with recent hard link activity.
• Hunt for known ransomware precursor behavior on hosts that remain unpatched for CVE-2019-1130.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.