CVE-2019-1315: Windows Error Reporting Manager hard link elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable privilege escalation with a vendor patch, listed in CISA KEV with known ransomware use, though it requires an existing foothold.

What it is

Windows Error Reporting Manager improperly handles hard links, allowing a local attacker to elevate privileges. The flaw is a link-following issue (CWE-59) affecting a broad set of Windows client and server releases. Because it is a local privilege escalation in a core Windows component, it matters as a post-compromise step to gain higher rights on a host.

Impact

An attacker who already has a foothold can escalate from low-privileged code execution to higher privileges on the affected system. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached locally (AV:L) with low privileges required (PR:L) and no user interaction (UI:N). No network vector or authentication bypass is described; the attacker must already be able to run code on the target.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-15 with a 2022-04-05 due date and flags known ransomware campaign use. EPSS 30-day probability is about 3.5 percent (88th percentile), and the only references are the Microsoft patch advisory and the CISA KEV entry.

What to do

• Apply the Microsoft security update for CVE-2019-1315 on all affected Windows client and server versions.
• Prioritize patching internet-facing and high-value hosts, and treat the CISA KEV due date as a hard deadline.
• Restrict local interactive and service account privileges to limit the value of a local escalation.
• Monitor for and block abuse of hard links in writable or shared directories used by Windows Error Reporting.

Detection

• Alert on unexpected hard link creation targeting Windows Error Reporting paths or system directories.
• Monitor process creation where WER-related binaries spawn elevated or unusual child processes.
• Correlate local privilege escalation attempts with subsequent credential access or ransomware precursor activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.