---
id: "CVE-2019-1215"
kind: "vulnerability"
aliases: ["CVE-2019-1215"]
title: "Microsoft Windows: Microsoft Windows Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.19254
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "ransomware", "windows", "windows-servers", "windows-workstations"]
not_affected_if: ["patched-systems"]
published_at: "2019-09-11T22:15:14+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1215", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-1215", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1215", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Microsoft Windows: Microsoft Windows Privilege Escalation Vulnerability

Windows Winsock driver ws2ifsl.sys mishandles objects in memory, letting a local user escalate privileges. An attacker who already has a foothold on the machine gets code running with elevated (SYSTEM-level) rights.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?

## Fix

Apply the Microsoft security update for CVE-2019-1215 per vendor instructions (CISA KEV required action).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1215
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-1215
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-1215

## From the sources

Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_