CVE-2019-1322: Windows authentication handling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is a local privilege escalation with a public exploit and KEV listing including known ransomware use, though it requires an existing foothold on the host.

What it is

Windows improperly handles authentication requests, allowing a local user to elevate privileges. The flaw affects several Windows 10 and Windows Server builds and is listed in CISA's Known Exploited Vulnerabilities catalog, so it matters for both patching and detection.

Impact

An attacker who already has a foothold on the host can gain elevated privileges, potentially reaching administrative or SYSTEM-level access. That access can be used to disable defenses, move laterally, or deploy ransomware.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already be able to run code on the target machine. It is not remotely reachable and does not require a victim to open a file or click a link.

Exploitation

CISA added this to KEV on 2022-03-15 with known ransomware campaign use, and a public exploit reference exists on Packet Storm. EPSS is 0.19205 (97th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2019-1322 to all affected Windows 10 and Windows Server builds.
• Prioritize patching hosts that are internet-facing or used for privileged administration, since KEV lists known ransomware use.
• Restrict local logon and code execution rights so unprivileged users cannot run arbitrary code on sensitive systems.
• Monitor for and remove unauthorized local accounts or tools that could be used to exploit local privilege escalation.
• Verify patch coverage across Windows 10 1803, 1809, 1903 and Windows Server 1803, 1903, 2019.

Detection

• Alert on unexpected creation of privileged local accounts or addition to Administrators/SYSTEM-equivalent groups.
• Monitor process creation for known local privilege escalation exploit tooling and unusual parent-child relationships involving authentication components.
• Review Windows security event logs for anomalous token or privilege use on hosts running unpatched builds.
• Correlate endpoint telemetry with KEV-listed exploitation attempts and ransomware precursor behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.