CVE-2019-1184: Windows Core Shell COM Server Registrar Elevation of Privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityAlthough CVSS is medium (6.7) and exploitation requires local access and user interaction, the high EPSS score and privilege escalation impact warrant prompt patching and monitoring.

What it is

Windows Core Shell COM Server Registrar improperly handles COM calls, leaving them unprotected. A logged-on attacker can run a crafted application to set certain items to run at a higher level and elevate permissions. The flaw matters because it allows local privilege escalation on affected Windows 10 and Windows Server systems.

Impact

An attacker who successfully exploits the flaw can elevate permissions and take control of the affected system. This can lead to full compromise of the host under the attacker's control.

Attack surface

The vulnerability is local (AV:L) and requires the attacker to first log on to the system. Exploitation also requires user interaction (UI:R) and low privileges (PR:L), meaning a local user must run a specially crafted application.

Exploitation

CISA KEV does not list this CVE, and no public exploit or ransomware usage is documented in the record. EPSS is high (0.70227, 99.348th percentile), indicating elevated predicted exploitation activity despite the lack of confirmed in-the-wild reports.

What to do

• Apply the Microsoft security update referenced in the vendor advisory to correct unprotected COM calls.
• Restrict interactive logon and local user rights to reduce the pool of accounts that can run crafted applications.
• Enforce least privilege so standard users cannot execute untrusted binaries or scripts on affected hosts.
• Monitor for and block execution of unknown or unsigned applications on Windows 10 and Windows Server 2016/2019 systems.

Detection

• Monitor process creation for unusual or unsigned binaries launched by standard users that interact with COM components.
• Audit Windows event logs for privilege escalation indicators, such as unexpected token elevation or process integrity level changes.
• Track COM object registration and activation events for the Core Shell COM Server Registrar that deviate from baseline.
• Correlate local logon events with subsequent suspicious process execution on affected Windows hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.