CVE-2019-1064
Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability
Description
CVE-2019-1064 is a high-severity improper link resolution vulnerability affecting Microsoft Windows. A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. This vulnerability has been associated with ransomware campaigns, heightening its risk profile. CISA has added CVE-2019-1064 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 11.34% (93.4th percentile), this vulnerability has a significant probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 10 1809 | - |
| microsoft | windows 10 1903 | - |
| microsoft | windows server 1709 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 1903 | - |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1064(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1064(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1064(US Government Resource)
Weakness Type
CWE-59: Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access, commonly known as "Link Following" or "Symlink Attack," occurs when software accesses a file through a path that can be modified by an attacker who creates or manipulates symbolic links (symlinks), hard links, or junctions. The vulnerability arises when a program follows a symbolic link to access a file without verifying that the link points to an intended and authorized location. In the case of CVE-2019-1064, this weakness manifests in Microsoft Windows where a privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Learn more: CWE-59 — Improper Link Resolution Before File Access ('Link Following')
Impact Analysis
CVE-2019-1064 represents a significant threat to organizations using Microsoft Windows, carrying a CVSS score of 7.8. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. The documented association with ransomware campaigns makes this vulnerability particularly dangerous, as threat actors actively leverage it for initial access or privilege escalation in ransomware operations.
Exploit Maturity
CVE-2019-1064 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 11.34% (93.4th percentile) indicates a significant probability of exploitation in the wild. This vulnerability has been linked to ransomware campaigns, indicating that well-resourced threat actors are actively incorporating it into their attack chains.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Update Microsoft Windows to the latest available version that addresses this vulnerability.
- Until the patch is applied, enforce the principle of least privilege by limiting local user access to only those who require it, and restrict the ability to execute untrusted applications on affected systems.
- Given the ransomware association, ensure endpoint detection and response (EDR) solutions are active on all affected systems and monitor for indicators of compromise including unusual process execution, file encryption activity, and lateral movement.
- Verify the patch deployment across all instances of Microsoft Windows in your environment using vulnerability scanning to confirm no systems remain exposed.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-05 are addressed within the required timeframe.
Technical Details
CVE-2019-1064 is classified under CWE-59 (Improper Link Resolution Before File Access ('Link Following')) affecting Microsoft Windows. A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. The vulnerability is exploitable with local access to the target system, with low attack complexity, requiring low-level privileges. The CVSS 3.1 base score of 7.8 (HIGH) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2019-1064 being actively exploited?
Yes. CVE-2019-1064 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 11.34% (93.4th percentile) indicates a significant probability of exploitation. This vulnerability has also been associated with ransomware campaigns.
What products are affected by CVE-2019-1064?
CVE-2019-1064 primarily affects Microsoft Windows, as well as Microsoft Windows 10 1607, Microsoft Windows 10 1703, Microsoft Windows 10 1709. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2019-1064?
Apply updates per vendor instructions. Until the update is applied, limit local access privileges and monitor for suspicious activity on affected systems.
How severe is CVE-2019-1064?
CVE-2019-1064 has a CVSS 3.1 score of 7.8, rated HIGH. This high severity rating indicates significant potential impact on affected systems. The association with ransomware campaigns further elevates the operational risk posed by this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.