{"id":"CVE-2019-1215","kind":"vulnerability","aliases":["CVE-2019-1215"],"related":[],"title":"Microsoft Windows: Microsoft Windows Privilege Escalation Vulnerability","description":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Windows Winsock driver ws2ifsl.sys mishandles objects in memory, letting a local user escalate privileges. An attacker who already has a foothold on the machine gets code running with elevated (SYSTEM-level) rights.","severity":"high","cvss":7.8,"epss":0.19254,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","windows","windows-servers","windows-workstations"],"not_affected_if":["patched-systems"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2019-1215 per vendor instructions (CISA KEV required action).","status":"open","published_at":"2019-09-11T22:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:20+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:37:20Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2019-1215 per vendor instructions (CISA KEV required action).\nunknown","reach":"local","impact":"high","summary":"Windows Winsock driver ws2ifsl.sys mishandles objects in memory, letting a local user escalate privileges. An attacker who already has a foothold on the machine gets code running with elevated (SYSTEM-level) rights.","category":"infrastructure","who_cares":["windows","windows-servers","windows-workstations"],"confidence":0.6,"needs_auth":"yes","worst_case":"local attacker gains elevated privileges and runs arbitrary code","analyst_note":"Sources do not name affected Windows builds or the patch KB; check Microsoft's CVE-2019-1215 advisory and confirm the ransomware tag's source before relying on it.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-systems"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000468,"input_tokens":2867,"output_tokens":363,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Sources do not name affected Windows builds or the patch KB; check Microsoft's CVE-2019-1215 advisory and confirm the ransomware tag's source before relying on it.","search":"'-1215':10A,13A '-2019':9A,12A 'action':92C 'allow':75C,81C 'alreadi':43B 'appli':93C 'attack':41B,83C 'cisa':90C 'code':51B,86C 'contain':61C 'cve':8A,11A 'driver':28B 'due':65C 'elev':54B,88C 'escal':6A,38B,78C 'execut':85C 'exploit':16B,80C 'foothold':46B 'get':50B 'handl':71C 'infrastructur':17B 'instruct':97C 'let':34B 'level':57B 'local':36B 'machin':49B 'memori':33B,74C 'microsoft':1A,3A,14A,59C 'mishandl':30B 'object':31B,72C 'per':95C 'privileg':5A,39B,77C,89C 'ransomwar':18B 'requir':91C 'right':58B 'run':52B 'server':22B 'success':79C 'system':56B 'system-level':55B 'unspecifi':63C 'updat':94C 'user':37B 'vendor':96C 'vulner':7A,64C 'way':68C 'window':2A,4A,19B,21B,24B,26B,60C 'windows':15A 'windows-serv':20B 'windows-workst':23B 'winsock':27B,70C 'workstat':25B 'ws2ifsl.sys':29B,69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-09-11T22:15:14+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-1215","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1215","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T12:39:25+00:00","note":null},{"source":"epss","external_id":"CVE-2019-1215","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1215","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-1215","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1215","severity":null,"published_at":"2019-09-11T22:15:14+00:00","modified_at":"2026-06-17T02:28:05+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}