---
id: "CVE-2019-1253"
kind: "vulnerability"
aliases: ["CVE-2019-1253"]
title: "Microsoft Windows: Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.11616
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "ransomware", "windows", "windows-10", "windows-server"]
not_affected_if: ["patched-systems"]
published_at: "2019-09-11T22:15:16+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1253", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-1253", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1253", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Windows: Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

Windows AppX Deployment Server improperly handles junctions, letting a local user escalate privileges. An attacker with a low-privilege account on the machine can gain SYSTEM-level control.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?

## Fix

Apply the Microsoft security update for CVE-2019-1253 per vendor instructions (CISA required action). Specific patched build numbers are not in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1253
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-1253
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-1253

## From the sources

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_