{"id":"CVE-2019-0841","aliases":["EUVD-2019-1592","GHSA-wqq2-j7vf-7rw9"],"status":"published","title":"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC)...","description":"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.414,"percentile":0.98683,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-59"],"published":"2019-04-09T20:18:32Z","modified":"2026-06-17T02:09:01Z","kev":{"date_added":"2022-03-15","due_date":"2022-04-05","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-03-15"},{"source":"kev","since":"2022-03-15"}],"exploits":[{"source":"pocgithub","id":"rogue-kdc/CVE-2019-0841","title":"rogue-kdc/CVE-2019-0841","date":"2019-04-05","url":"https://github.com/rogue-kdc/CVE-2019-0841"},{"source":"exploitdb","id":"EDB-46683","title":"Microsoft Windows - AppX Deployment Service Privilege Escalation","type":"local","platform":"windows","date":"2019-04-09","url":"https://www.exploit-db.com/exploits/46683"},{"source":"metasploit","id":"exploit/windows/local/appxsvc_hard_link_privesc","title":"AppXSvc Hard Link Privilege Escalation","type":"exploit","platform":"Windows","date":"2019-04-09","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/local/appxsvc_hard_link_privesc"},{"source":"pocgithub","id":"likekabin/CVE-2019-0841","title":"likekabin/CVE-2019-0841","date":"2019-04-10","url":"https://github.com/likekabin/CVE-2019-0841"},{"source":"exploitdb","id":"EDB-46938","title":"Microsoft Windows - AppX Deployment Service Local Privilege Escalation (2)","type":"local","platform":"windows","date":"2019-05-23","url":"https://www.exploit-db.com/exploits/46938"},{"source":"exploitdb","id":"EDB-46976","title":"Microsoft Windows - AppX Deployment Service Local Privilege Escalation (3)","type":"local","platform":"windows","date":"2019-06-07","url":"https://www.exploit-db.com/exploits/46976"},{"source":"pocgithub","id":"0x00-0x00/CVE-2019-0841-BYPASS","title":"0x00-0x00/CVE-2019-0841-BYPASS","date":"2019-06-11","url":"https://github.com/0x00-0x00/CVE-2019-0841-BYPASS"},{"source":"exploitdb","id":"EDB-47128","title":"Microsoft Windows 10 \u003c build 17763 - AppXSvc Hard Link Privilege Escalation (Metasploit)","type":"local","platform":"windows","date":"2019-07-16","verified":true,"url":"https://www.exploit-db.com/exploits/47128"},{"source":"pocgithub","id":"mappl3/CVE-2019-0841","title":"mappl3/CVE-2019-0841","date":"2022-04-09","url":"https://github.com/mappl3/CVE-2019-0841"}],"products":[{"vendor":"microsoft","product":"windows"},{"vendor":"microsoft","product":"windows server"},{"vendor":"microsoft","product":"windows_10_1703"},{"vendor":"microsoft","product":"windows_10_1709"},{"vendor":"microsoft","product":"windows_10_1803"},{"vendor":"microsoft","product":"windows_10_1809"},{"vendor":"microsoft","product":"windows_server_2016"},{"vendor":"microsoft","product":"windows_server_2019"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0841","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46683/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/152463/Microsoft-Windows-AppX-Deployment-Service-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-19-360/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153009/Internet-Explorer-JavaScript-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153114/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153215/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153642/AppXSvc-Hard-Link-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0841","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0841"},{"url":"https://www.exploit-db.com/exploits/46683"},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-19-360"},{"url":"https://github.com/advisories/GHSA-wqq2-j7vf-7rw9"}],"sources":{"cve":[{"id":"CVE-2019-0841","description":"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.","status":"published","published":"2019-04-09T20:18:32Z","modified":"2025-10-21T23:45:39.637Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:32:24.473448Z"}],"euvd":[{"id":"EUVD-2019-1592","description":"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.","status":"published","published":"2019-04-09T20:18:32Z","modified":"2025-10-21T23:45:39Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-03-15","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-wqq2-j7vf-7rw9","title":"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC)...","description":"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.","status":"published","published":"2022-05-13T01:21:38Z","modified":"2025-10-22T00:31:39Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2019-0841","title":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","description":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","cwes":["CWE-59"],"kev":{"date_added":"2022-03-15","due_date":"2022-04-05","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2019-0841","description":"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.","status":"published","published":"2019-04-09T21:29:01.99Z","modified":"2026-06-17T02:09:01.233Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:11.426883Z"}]}}