{"id":"CVE-2019-1388","kind":"vulnerability","aliases":["CVE-2019-1388"],"related":[],"title":"An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce…","description":"Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Windows Certificate Dialog has a privilege escalation flaw. An attacker with a local foothold can run processes in an elevated context.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-04-07T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1709","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1803","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1903","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 7","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 8.1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows rt 8.1","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 1903","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":[],"affected":"= 1803","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","ransomware","windows"],"not_affected_if":["fully-patched"],"how_to_check":null,"fix":"Apply the Microsoft Windows updates for CVE-2019-1388 per vendor instructions, as directed by CISA.","status":"open","published_at":"2019-11-12T19:15:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:59+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:06:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft Windows updates for CVE-2019-1388 per vendor instructions, as directed by CISA.","reach":"local","impact":"high","summary":"Microsoft Windows Certificate Dialog has a privilege escalation flaw. An attacker with a local foothold can run processes in an elevated context.","category":"infrastructure","who_cares":["windows"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker gains elevated privileges on the Windows machine, possibly SYSTEM.","analyst_note":"Confirm affected Windows builds and the patch KB numbers from Microsoft's advisory for CVE-2019-1388; the sources give no version list.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fully-patched"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000441,"input_tokens":2799,"output_tokens":323,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1388':20A,23A '-2019':19A,22A '10':28A,32A,36A,40A,44A,48A '1507':29A '1607':33A '1709':37A '1803':41A '1809':45A '1903':49A,63A '2008':67A,71A '2012':75A,79A '2016':83A,87A '2019':91A '7':52A '8.1':55A,59A 'action':138C 'allow':127C 'appli':139C 'attack':106B,128C 'certif':10A,98B,120C 'cisa':136C 'contain':122C 'context':117B,135C 'cve':18A,21A 'dialog':11A,99B,121C 'elev':2A,116B,134C 'enforc':17A 'escal':103B,125C 'exist':6A 'exploit':92B 'flaw':104B 'foothold':110B 'infrastructur':93B 'instruct':143C 'local':109B 'microsoft':24A,26A,30A,34A,38A,42A,46A,50A,53A,56A,60A,64A,68A,72A,76A,80A,84A,88A,96B,118C 'per':141C 'privileg':4A,102B,124C 'process':113B,131C 'proper':16A 'ransomwar':94B 'requir':137C 'rt':58A 'run':112B,130C 'server':62A,66A,70A,74A,78A,82A,86A,90A 'updat':140C 'vendor':142C 'vulner':5A,126C 'window':9A,95B,97B,119C 'windows':25A,27A,31A,35A,39A,43A,47A,51A,54A,57A,61A,65A,69A,73A,77A,81A,85A,89A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-11-12T19:15:12+00:00","kev":{"dateAdded":"2023-04-07","dueDate":"2023-04-28","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-1388","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1388","severity":null,"published_at":"2023-04-07T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-1388","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1388","severity":null,"published_at":"2019-11-12T19:15:12+00:00","modified_at":"2026-06-17T02:28:30+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}