CVE-2019-1253: Windows AppX Deployment Server junction handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8, confirmed KEV listing with ransomware use, and a public exploit make this a high-priority local privilege escalation despite requiring an existing foothold.

What it is

The Windows AppX Deployment Server mishandles junctions, allowing a local attacker who already has code execution to elevate privileges. It matters because the flaw is confirmed exploited in the wild and has been used in ransomware campaigns.

Impact

An attacker gains full control of the affected system, with high impact to confidentiality, integrity and availability. This typically means SYSTEM-level privileges on a Windows host.

Attack surface

Reached locally: the CVSS vector is AV:L with PR:L and UI:N, so the attacker needs existing low-privileged execution on the target and no user interaction. It is not remotely reachable and requires no authentication beyond that local foothold.

Exploitation

CISA added it to KEV on 2022-03-15 with known ransomware campaign use, and EPSS shows a 30-day probability of 0.116 (95.8th percentile). A public Packet Storm advisory exists, so exploitation is confirmed and active.

What to do

• Apply the Microsoft security update referenced in the vendor advisory (portal.msrc.microsoft.com) to all affected Windows 10 and Windows Server builds.
• Prioritize patching internet-facing and high-value hosts, and treat unpatched endpoints as compromised-capable given KEV status.
• Restrict local interactive logon and execution rights to reduce the low-privileged foothold this exploit requires.
• Monitor for and block known ransomware tooling and post-exploitation behavior on unpatched systems.

Detection

• Alert on processes creating or following junctions in AppX-related paths, especially unusual parent processes spawning from user-writable directories.
• Hunt for privilege escalation from medium-integrity to SYSTEM integrity on hosts running affected Windows builds.
• Correlate local process creation events with known exploit artifacts from the public Packet Storm advisory.
• Track unpatched assets against the KEV due date and flag any that remain unpatched past 2022-04-05.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.