---
id: "CVE-2019-1405"
kind: "vulnerability"
aliases: ["CVE-2019-1405"]
title: "Microsoft Windows: Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.30168
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "ransomware", "self-hosted", "windows"]
not_affected_if: ["patched-windows"]
published_at: "2019-11-12T19:15:13+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1405", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-1405", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1405", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Windows: Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

The Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, which lets a local user raise their privileges. An attacker who already has a foothold on the machine gets SYSTEM-level control.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?

## Fix

Apply the Microsoft Windows updates for CVE-2019-1405 per vendor instructions (CISA KEV required action).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1405
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-1405
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-1405

## From the sources

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_