Microsoft Windows Privilege Escalation Vulnerability (CVE-2019-0543)
Published In CISA KEV since Sources: CVE.org
What is affected, what to do
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.
- Affected
- Microsoft Windows Server 2008
eq r2..r2 - Microsoft Windows Server 2012
eq r2..r2
- Microsoft Windows Server 2008
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
7.8
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
7.8
CVSS v3
Severity High on the scale from 0 to 10.
Source: CVE.org
4.7 %
EPSS score
Moderate — model estimates 1-10% exploitation likelihood.
Source: FIRST EPSS, percentile 91.8
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 231.43 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- actively exploited
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 7.8 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 7.8
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 4.7 %
- Moderate — model estimates 1-10% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 91.8
- Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- Actively exploited
- Published
In CISA KEV since
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- CISA assessment (SSVC)
- Exploitation: active · not automatable · Technical impact: total
- Source: CISA Vulnrichment, as of 4 February 2025
CWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-287
Response and mitigation
Why act now?
Prioritisation rationale
This is a local, low-privilege bug that needs no user interaction and gives full control of the host. That makes it a textbook post-initial-access step. CISA flags it for known ransomware use: operators chain it after phishing or a compromised RDP foothold to reach SYSTEM, kill security tooling and harvest credentials for lateral movement. Its likelihood of exploitation is well above average. On fully patched, supported Windows estates the residual risk is low. Treat it as high wherever EOL systems remain (Windows 7/Server 2008, early Windows 10 builds), particularly in OT and KRITIS environments, multi-user servers, or hosts with known initial-access exposure.
Runbook step 1
Immediate response (0-24 h)
- Verify and deploy the patch: Microsoft fixed this in the January 2019 Patch Tuesday security updates. Any later cumulative update or Monthly Rollup includes the fix. Look up the KB number per OS build in the Microsoft Security Update Guide entry for CVE-2019-0543. Confirm deployment via
Get-HotFix, OS build/UBR reporting in Intune/SCCM, or your vulnerability scanner. - Identify end-of-life hosts: Windows 7, Server 2008/2008 R2, Windows 8.1/RT 8.1 and Windows 10 1507–1803 are out of support or close to it. Inventory them. Any host that cannot prove at least the January 2019 baseline (or ESU coverage) goes into a quarantine VLAN or gets fast-tracked for replacement.
- Patch multi-user systems first: RDS/terminal servers, Citrix VDAs, jump hosts and build servers come first. On these hosts, many low-privileged users can already run code, which is exactly the precondition this bug needs.
- Hunt on already-compromised hosts: Review endpoints with open EDR alerts for initial access (phishing payloads, loaders, webshells) for follow-on escalation to SYSTEM using the detection rules below. Isolate the host on any hit.
- Rotate local admin and service account credentials on hosts suspected of escalation. SYSTEM context allows dumping LSASS and cached domain credentials.
- Verify and deploy the patch: Microsoft fixed this in the January 2019 Patch Tuesday security updates. Any later cumulative update or Monthly Rollup includes the fix. Look up the KB number per OS build in the Microsoft Security Update Guide entry for CVE-2019-0543. Confirm deployment via
Runbook step 2
Mitigation layers
- Application control (endpoint hardening): Use WDAC or AppLocker to block execution from user-writable paths:
%TEMP%,%APPDATA%,%LOCALAPPDATA%,C:\Users\Public,C:\ProgramData. Local privilege-escalation exploits are usually dropped there as a standalone binary or DLL. - Least privilege (IAM): Restrict the GPO rights "Allow log on locally" and "Allow log on through Remote Desktop Services" on servers to groups that genuinely need them. Every user without local code execution shrinks the attack surface.
- Contain the blast radius: Deploy Windows LAPS so each local admin password is unique, and enforce AD tiering (no Tier 0 logons on Tier 1/2 hosts). Enable Credential Guard and LSA protection (
RunAsPPL) where supported. - Segment legacy systems: Move unpatchable EOL hosts into a dedicated VLAN. Block SMB (445/tcp), RDP (3389/tcp), WinRM (5985/5986/tcp) and RPC (135/tcp) from client networks at the firewall. This cuts off the lateral paths attackers use to get local execution in the first place.
- EDR hardening: Turn on tamper protection and run ASR rules in block mode, especially "Block credential stealing from LSASS" and "Block executable files unless they meet a prevalence, age, or trusted list criterion".
- Application control (endpoint hardening): Use WDAC or AppLocker to block execution from user-writable paths:
Runbook step 3
Detection rules
- Integrity-level jump (EDR/Sysmon EID 1): A process running at
Systemintegrity whose parent runs atMedium/Lowand is not a legitimate service host. KQL (MDE):DeviceProcessEvents | where ProcessIntegrityLevel == "System" and InitiatingProcessIntegrityLevel in ("Medium","Low") and InitiatingProcessFolderPath !startswith @"C:\Windows\" - Loopback authentication (Security EID 4624/4648): The flaw is in how Windows handles authentication requests. Watch for network logons (Logon Type 3) from
127.0.0.1/::1asSYSTEMor the machine account, triggered by a standard user's process. SPL:index=wineventlog EventCode=4624 Logon_Type=3 (Source_Network_Address="127.0.0.1" OR Source_Network_Address="::1") | stats count by host, Account_Name, Process_Name - SYSTEM-level follow-on activity: New services (System EID 7045, Security EID 4697) or scheduled tasks (EID 4698) created shortly after an unknown binary runs from a user-profile path. Sigma shape:
selection: EventID 7045 AND ImagePath|contains: ['\Users\','\ProgramData\','\Temp\']. - LSASS access (Sysmon EID 10):
TargetImageending inlsass.exewithGrantedAccess0x1010/0x1410/0x1ffffffrom an unsigned or user-pathSourceImage. This is the typical next step after escalation. - Ransomware staging:
vssadmin delete shadows,wbadmin delete catalogorbcdedit /set recoveryenabled norunning as SYSTEM on a host that previously showed an integrity-level jump. Isolate immediately.
- Integrity-level jump (EDR/Sysmon EID 1): A process running at
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Source: cvelistv5, CISA KEV Catalog, NVD (NIST)
Vendors and products
- Microsoft Windows 10 1507
- Microsoft Microsoft Windows 10 1607
- Microsoft Windows 10 1703
- Microsoft Windows 10 1709
- Microsoft Windows 10 1803
- Microsoft Microsoft Windows 10 1809
- Microsoft Microsoft Windows 7
- Microsoft Microsoft Windows 8.1
- Microsoft Microsoft Windows RT 8.1
- Microsoft Windows Server 1709
- Microsoft Windows Server 1803
- Microsoft Microsoft Windows Server 2008
Affected operating systems
| Windows | microsoft | windows_10_1507 | — |
| Windows | microsoft | windows_10_1607 | — |
| Windows | microsoft | windows_10_1703 | — |
| Windows | microsoft | windows_10_1709 | — |
| Windows | microsoft | windows_10_1803 | — |
| Windows | microsoft | windows_10_1809 | — |
| Windows | microsoft | windows_7 | — |
| Windows | microsoft | windows_8.1 | — |
| Windows | microsoft | windows_rt_8.1 | — |
| Windows | microsoft | windows_server_1709 | — |
| Windows | microsoft | windows_server_1803 | — |
| Windows | microsoft | windows_server_2008 | r2 |
| Windows | microsoft | windows_server_2008 | — |
| Windows | microsoft | windows_server_2012 | r2 |
| Windows | microsoft | windows_server_2012 | — |
| Windows | microsoft | windows_server_2016 | — |
| Windows | microsoft | windows_server_2019 | — |
Weakness classes (CWE)
CWE-287Improper Authentication
Class
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Entry at MITRE CWE-287
Public exploit references
Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.
| CISA KEV Catalog | CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov | actively exploited | |
| Exploit-DB | EDB-ID 46156 (opens in a new tab)exploit-db.com | PoC (publicly reported)reported, not verified | — |
References & sources
- securityfocus.com106408Vulnerability database, x_refsource_BID
- portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2019-0543x_refsource_CONFIRM
- exploit-db.com46156Exploit, x_refsource_EXPLOIT-DB
- cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0543government-resource
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2019-0543"><img src="https://intel.neosec.eu/badge/cve/CVE-2019-0543.svg?lang=en" alt="CVE-2019-0543 – NEOSEC Intel" height="20"></a>