CVE-2019-1405: Windows UPnP Service Improper COM Object Creation Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8, confirmed active exploitation in CISA KEV with ransomware use, and a wide affected product base make this a high-priority local privilege escalation flaw.

What it is

The Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, enabling a local attacker to elevate privileges. The flaw affects a broad set of Windows client and server versions and is listed in CISA's Known Exploited Vulnerabilities catalog, so it is a confirmed real-world target.

Impact

An attacker who can run code on a vulnerable host gains elevated privileges, up to SYSTEM, allowing full control of the machine. This enables credential theft, persistence, and lateral movement.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have a foothold on the host. The UPnP service is reachable locally and does not require network access or user action.

Exploitation

CISA KEV lists this as actively exploited with known ransomware campaign use, and EPSS shows a 30-day probability of 0.2995 (98th percentile). A public Packet Storm advisory exists, indicating exploit code is available.

What to do

• Apply the Microsoft security update for CVE-2019-1405 on all affected Windows versions immediately.
• Disable the UPnP Device Host and SSDP Discovery services where UPnP is not required.
• Restrict local logon and code execution to trusted users to reduce the initial foothold needed for exploitation.
• Monitor and block unnecessary COM object creation from low-privileged processes via application control policies.
• Verify patching across all listed Windows 7, 8.1, 10, and Server editions, including legacy systems.

Detection

• Monitor for unexpected child processes spawning from svchost.exe hosting the UPnP service with SYSTEM-level tokens.
• Audit Windows event logs for privilege escalation indicators such as new service creation or token manipulation by non-admin users.
• Hunt for known exploit artifacts or COM object instantiation patterns associated with the UPnP service from low-integrity processes.
• Track CISA KEV remediation status and alert on unpatched hosts running the UPnP service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.