CVE-2019-1385
A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1385PatchVendor Advisory
- zerodayinitiative.com/advisories/ZDI-19-979/Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1385US Government Resource
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1597 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 3.6% · top 11% of all CVEs
- Weakness
- CWE-59
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 4.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.