{"id":"CVE-2019-1253","aliases":["EUVD-2019-9819","GHSA-wp5j-ppw9-22mw"],"status":"published","title":"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly...","description":"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.11616,"percentile":0.96071,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-59"],"published":"2019-09-11T21:24:59Z","modified":"2026-06-17T02:28:14Z","kev":{"date_added":"2022-03-15","due_date":"2022-04-05","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-03-15"},{"source":"kev","since":"2022-03-15"}],"exploits":[{"source":"pocgithub","id":"rogue-kdc/CVE-2019-1253","title":"rogue-kdc/CVE-2019-1253","date":"2019-04-10","url":"https://github.com/rogue-kdc/CVE-2019-1253"},{"source":"pocgithub","id":"likekabin/CVE-2019-1253","title":"likekabin/CVE-2019-1253","date":"2019-09-11","url":"https://github.com/likekabin/CVE-2019-1253"},{"source":"pocgithub","id":"padovah4ck/CVE-2019-1253","title":"padovah4ck/CVE-2019-1253","date":"2019-09-11","url":"https://github.com/padovah4ck/CVE-2019-1253"},{"source":"pocgithub","id":"sgabe/CVE-2019-1253","title":"sgabe/CVE-2019-1253","date":"2019-09-11","url":"https://github.com/sgabe/CVE-2019-1253"},{"source":"exploitdb","id":"EDB-47389","title":"AppXSvc - Privilege Escalation","type":"local","platform":"windows","date":"2019-09-16","url":"https://www.exploit-db.com/exploits/47389"}],"products":[{"vendor":"microsoft","product":"windows"},{"vendor":"microsoft","product":"windows 10 version 1903 for 32-bit systems"},{"vendor":"microsoft","product":"windows 10 version 1903 for arm64-based systems"},{"vendor":"microsoft","product":"windows 10 version 1903 for x64-based systems"},{"vendor":"microsoft","product":"windows server"},{"vendor":"microsoft","product":"windows server, version 1903 (server core installation)"},{"vendor":"microsoft","product":"windows_10_1703"},{"vendor":"microsoft","product":"windows_10_1709"},{"vendor":"microsoft","product":"windows_10_1803"},{"vendor":"microsoft","product":"windows_10_1809"},{"vendor":"microsoft","product":"windows_10_1903"},{"vendor":"microsoft","product":"windows_server_1803"},{"vendor":"microsoft","product":"windows_server_1903"},{"vendor":"microsoft","product":"windows_server_2019"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1253","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/154488/AppXSvc-17763.1.amd64fre.rs5_release.180914-1434-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1253","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1253"},{"url":"https://github.com/advisories/GHSA-wp5j-ppw9-22mw"}],"sources":{"cve":[{"id":"CVE-2019-1253","description":"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.","status":"published","published":"2019-09-11T21:24:59Z","modified":"2025-10-21T23:45:30.968Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:20:26.034547Z"}],"euvd":[{"id":"EUVD-2019-9819","description":"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.","status":"published","published":"2019-09-11T21:24:59Z","modified":"2025-10-21T23:45:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-03-15","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-wp5j-ppw9-22mw","title":"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly...","description":"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.","status":"published","published":"2022-05-24T16:56:01Z","modified":"2025-10-22T00:32:48Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2019-1253","title":"Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability","description":"A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.","cwes":["CWE-59"],"kev":{"date_added":"2022-03-15","due_date":"2022-04-05","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2019-1253","description":"An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.","status":"published","published":"2019-09-11T22:15:16.337Z","modified":"2026-06-17T02:28:14.563Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:28.126831Z"}]}}