{"id":"CVE-2019-1069","kind":"vulnerability","aliases":["CVE-2019-1069"],"related":[],"title":"Microsoft Task Scheduler: Microsoft Task Scheduler Privilege Escalation Vulnerability","description":"An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system.\nTo exploit the vulnerability, an attacker would require unprivileged code execution on a victim system.\nThe security update addresses the vulnerability by correctly validating file operations.","summary":"Microsoft Windows Task Scheduler service mishandles certain file operations, letting a local user escalate privileges. An attacker with a low-privileged account on the machine can gain higher rights, and CISA lists it as actively exploited, with ransomware use noted in the tags.","severity":"high","cvss":7.8,"epss":0.06117,"exploited":true,"exploited_at":"2022-03-15T00:00:00+00:00","products":[{"name":"Microsoft Task Scheduler","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","self-hosted","task-scheduler","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2019-1069 per vendor instructions (CISA required action); exact KB and build numbers are not in the sources.","status":"open","published_at":"2019-06-12T14:29:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:17+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:22:17Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2019-1069 per vendor instructions (CISA required action); exact KB and build numbers are not in the sources.\nunknown","reach":"local","impact":"high","summary":"Microsoft Windows Task Scheduler service mishandles certain file operations, letting a local user escalate privileges. An attacker with a low-privileged account on the machine can gain higher rights, and CISA lists it as actively exploited, with ransomware use noted in the tags.","category":"infrastructure","who_cares":["windows","task-scheduler","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local low-privilege user gains administrator rights on the Windows machine.","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2019-1069 to get affected Windows builds, patch KB numbers and a detection method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000474,"input_tokens":2830,"output_tokens":382,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1069':12A,15A '-2019':11A,14A 'account':51B 'activ':64B 'address':123C 'attack':45B,91C,110C 'certain':35B,87C 'cisa':60B 'code':114C 'correct':127C 'could':97C 'cve':10A,13A 'elev':74C,99C 'escal':8A,42B 'execut':115C 'exist':78C 'exploit':19B,65B,94C,106C 'file':36B,88C,129C 'gain':56B,98C 'higher':57B 'host':24B 'infrastructur':20B 'let':38B 'list':61B 'local':40B 'low':49B 'low-privileg':48B 'machin':54B 'microsoft':1A,4A,16A,29B 'mishandl':34B 'note':69B 'oper':37B,89C,130C 'privileg':7A,43B,50B,76C,100C 'ransomwar':21B,67B 'requir':112C 'right':58B 'schedul':3A,6A,27B,32B,84C 'scheduler':18A 'secur':121C 'self':23B 'self-host':22B 'servic':33B,85C 'success':93C 'system':104C,119C 'tag':72B 'task':2A,5A,17A,26B,31B,83C 'task-schedul':25B 'unprivileg':113C 'updat':122C 'use':68B 'user':41B 'valid':86C,128C 'victim':103C,118C 'vulner':9A,77C,96C,108C,125C 'way':81C 'window':28B,30B 'would':111C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-06-12T14:29:04+00:00","kev":{"dateAdded":"2022-03-15","dueDate":"2022-04-05","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-1069","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1069","severity":null,"published_at":"2022-03-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2019-1069","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1069","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-1069","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1069","severity":null,"published_at":"2019-06-12T14:29:04+00:00","modified_at":"2026-08-12T05:17:22+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}