Vulnerability record · CVE-2019-1385 · published 12 November 2019
CVE-2019-1385: Windows AppX Deployment Extensions privilege escalation via link following
Microsoft · Windows 10 1709
Windows AppX Deployment Extensions performs privilege management improperly, allowing a local authenticated attacker to reach system files through a link-following flaw (CWE-59). A successful attack elevates privileges on the host, which matters because the flaw is listed in CISA KEV and has been associated with ransomware campaigns.
Description
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.8 with local authenticated access, KEV listing and documented ransomware use make this a high-priority patch despite the local attack vector.
What it is
Windows AppX Deployment Extensions performs privilege management improperly, allowing a local authenticated attacker to reach system files through a link-following flaw (CWE-59). A successful attack elevates privileges on the host, which matters because the flaw is listed in CISA KEV and has been associated with ransomware campaigns.
Impact
An attacker gains elevated privileges and access to system files on the affected Windows host, enabling further compromise such as credential theft or defense evasion.
Attack surface
The attack is local: the attacker must already have authenticated access and run a specially crafted application on the target system. No user interaction beyond running the crafted application is required, per the CVSS vector (AV:L/PR:L/UI:N).
Exploitation
CVE-2019-1385 is in CISA KEV (added 2022-05-23) with known ransomware campaign use, and EPSS 30-day probability is about 3.6 percent (88.9th percentile). References include vendor patch and third-party advisories but no public exploit tag.
What to do
- Apply the Microsoft security update for CVE-2019-1385 on all affected Windows 10 and Windows Server builds.
- Prioritize patching systems that are internet-facing or used for privileged administration, given KEV listing and ransomware association.
- Restrict local logon and application execution rights to reduce the authenticated attacker population that can reach this flaw.
- Monitor for and block untrusted executables that abuse AppX Deployment Extensions or create suspicious links in privileged paths.
Detection
- Alert on unexpected child processes or file writes originating from AppX Deployment Extension components.
- Hunt for link or junction creation in system directories that could redirect privileged file operations.
- Correlate local privilege escalation events (for example, token or integrity-level changes) with recent execution of unsigned or unusual binaries.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2019-1385 to the Known Exploited Vulnerabilities catalog on 23 May 2022 as "Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 13 June 2022.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1385 | PatchVendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-19-979/ | Third Party Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1385 | PatchVendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-19-979/ | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1385 | US Government Resource |
Track CVE-2019-1385 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-1385), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
