{"id":"CVE-2019-1253","kind":"vulnerability","aliases":["CVE-2019-1253"],"related":[],"title":"Microsoft Windows: Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability","description":"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.","summary":"Windows AppX Deployment Server improperly handles junctions, letting a local user escalate privileges. An attacker with a low-privilege account on the machine can gain SYSTEM-level control.","severity":"high","cvss":7.8,"epss":0.11616,"exploited":true,"exploited_at":"2022-03-15T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","windows","windows-10","windows-server"],"not_affected_if":["patched-systems"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2019-1253 per vendor instructions (CISA required action). Specific patched build numbers are not in the sources.","status":"open","published_at":"2019-09-11T22:15:16+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:17+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:22:17Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2019-1253 per vendor instructions (CISA required action). Specific patched build numbers are not in the sources.","reach":"local","impact":"high","summary":"Windows AppX Deployment Server improperly handles junctions, letting a local user escalate privileges. An attacker with a low-privilege account on the machine can gain SYSTEM-level control.","category":"infrastructure","who_cares":["windows","windows-10","windows-server"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the Windows machine","analyst_note":"Confirm affected Windows builds and the patch KB from the Microsoft advisory for CVE-2019-1253; sources list affected/fixed versions as unknown and KEV says it is used in ransomware campaigns.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-systems"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000466,"input_tokens":2829,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-10':24B '-1215':102C '-1253':13A,16A '-1278':105C '-1303':108C '-2019':12A,15A,101C,104C,107C 'account':48B 'aka':88C 'appx':5A,29B,67C 'attack':42B,77C 'control':57B 'cve':11A,14A,95C,100C,103C,106C 'deploy':6A,30B,68C 'elev':59C,90C 'escal':9A,39B 'execut':83C 'exist':63C 'exploit':19B,73C 'first':79C 'gain':53B,82C 'handl':33B,71C 'id':96C 'improp':32B,70C 'infrastructur':20B 'junction':34B 'junctions.to':72C 'let':35B 'level':56B 'local':37B 'low':46B 'low-privileg':45B 'machin':51B 'microsoft':1A,3A,17A 'privileg':8A,40B,47B,61C,92C 'ransomwar':21B 'server':7A,27B,31B,69C 'system':55B,87C 'system-level':54B 'uniqu':98C 'user':38B 'victim':86C 'vulner':10A,62C,75C,93C 'window':2A,4A,22B,23B,26B,28B,66C,89C 'windows':18A 'windows-serv':25B 'would':78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-09-11T22:15:16+00:00","kev":{"dateAdded":"2022-03-15","dueDate":"2022-04-05","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-1253","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1253","severity":null,"published_at":"2022-03-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2019-1253","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-1253","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-1253","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1253","severity":null,"published_at":"2019-09-11T22:15:16+00:00","modified_at":"2026-06-17T02:28:14+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}