Windows Elevation of Privilege Vulnerability (CVE-2019-1064)

What is affected, what to do

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows 10 Version 1703 gte 10.0.0..*
• Microsoft Windows 10 Version 1803 gte 10.0.0..*
• Microsoft Windows Server, version 1803 (Server Core Installation) gte 10.0.0..*
• Microsoft Windows 10 Version 1809 gte 10.0.17763.0..*
• Microsoft Windows 10 Version 1809 gte 10.0.0..*
• Microsoft Windows Server 2019 gte 10.0.17763.0..*
• Microsoft Windows Server 2019 (Server Core installation) gte 10.0.17763.0..*
• Microsoft Windows 10 Version 1709 for 32-bit Systems gte 10.0.0..*
• Microsoft Windows 10 Version 1709 gte 10.0.0..*
• Microsoft Windows 10 Version 1903 for 32-bit Systems gte 10.0.0..*
• Microsoft Windows 10 Version 1903 for x64-based Systems gte 10.0.0..*
• Microsoft Windows 10 Version 1903 for ARM64-based Systems gte 10.0.0..*
• Microsoft Windows Server, version 1903 (Server Core installation) gte 10.0.0..*
• Microsoft Windows 10 Version 1607 gte 10.0.14393.0..*
• Microsoft Windows Server 2016 gte 10.0.14393.0..*
• Microsoft Windows Server 2016 (Server Core installation) gte 10.0.14393.0..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy the security update: Roll out Microsoft's fix for CVE-2019-1064 (Windows cumulative update) to every affected Windows 10 system. The patch is available from the vendor — look up the KB number per build in the Microsoft Security Update Guide. Confirm coverage by build number via Intune, SCCM/MECM or WSUS reporting.
   • Hunt down unsupported builds: Windows 10 1607, 1703, 1709 and 1803 are out of mainstream servicing unless they are LTSB/LTSC. Pull them from CMDB or asset inventory and queue them for a feature upgrade to a supported build. Flag anything that cannot be upgraded as a high-risk asset.
   • Patch multi-user and jump systems first: Exploitation requires a local logon. Terminal servers/VDI, jump hosts, kiosk and training machines, and hosts with third-party contractor access therefore come first.
   • Treat suspected hosts as SYSTEM-compromised: Where exploitation is suspected, isolate the host via EDR network containment. Rotate the local admin password (LAPS) and treat any cached domain credentials on the box as exposed.
   • Check the ransomware context: CISA confirms use in ransomware campaigns, so correlate the last 30 days of initial-access alerts (phishing payloads, loaders) on the same hosts. This bug is typically the second stage after an initial foothold.
2. 02

   Runbook step 2

   Mitigation layers

   • Application control (endpoint hardening): Use AppLocker or WDAC to block unsigned binaries from user-writable paths (%USERPROFILE%, %TEMP%, %LOCALAPPDATA%, Downloads). The exploit depends on the logged-on user running a crafted application.
   • Least privilege / IAM: Restrict "Allow log on locally" and "Allow log on through Remote Desktop Services" to the groups that need them. Deny interactive logon for service accounts. Strip standing local admin rights to slow down follow-on actions.
   • EDR hardening: Run behavioural rules for hard-link abuse and privilege escalation in block mode, not audit mode. Enable tamper protection so the agent cannot be killed once SYSTEM is obtained.
   • Configuration change (last resort, test first): Disable AppXSVC via HKLM\SYSTEM\CurrentControlSet\Services\AppXSvc with Start=4. This breaks Store/UWP apps and can disrupt the Start menu and the Settings app. Reserve it for kiosk or server-role systems with no AppX dependency.
   • Network segmentation: Move unpatched legacy systems into a dedicated VLAN without direct reach to domain controller management interfaces or file shares. This limits lateral movement after a local escalation.
3. 03

   Runbook step 3

   Detection rules

   • Permission changes on system files (Windows Security log): Event ID 4670 ("Permissions on an object were changed") with ObjectName under C:\Windows\ or C:\Program Files\, triggered by svchost.exe in the AppXSVC context. This requires SACL auditing on critical directories. Sigma shape: EventID=4670 AND ObjectName|startswith 'C:\Windows\System32\' AND ProcessName|endswith '\svchost.exe'.
   • Hard-link creation by standard users (EDR telemetry): Hard links from %LOCALAPPDATA%\Packages\ pointing at files in C:\Windows\ or C:\Program Files\, for example via CreateHardLink or NtSetInformationFile with FileLinkInformation. Weight unsigned creating processes running from user paths more heavily.
   • Writes to system binaries (Sysmon EID 11 / Defender DeviceFileEvents): Processes other than TrustedInstaller, msiexec or Windows Update modifying files in System32. KQL: DeviceFileEvents | where FolderPath startswith @"C:\Windows\System32\" and InitiatingProcessAccountName !in~ ("system","trustedinstaller") and ActionType in ("FileModified","FileCreated").
   • Anomalous process ancestry (Sysmon EID 1 / EDR): cmd.exe, powershell.exe or unknown binaries running as NT AUTHORITY\SYSTEM under a service parent, shortly after the same user touched files in %LOCALAPPDATA%\Packages\. Correlate the user-context process and the SYSTEM shell within a window of up to 5 minutes.
   • Post-escalation activity: Event ID 4720/4732 (account created or added to Administrators) or Event ID 7045 (new service installed) on workstations with no matching change ticket indicate a successful escalation.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog

Vendors and products

• Microsoft Microsoft Windows 10 1607
• Microsoft Windows 10 1703
• Microsoft Windows 10 1709
• Microsoft Windows 10 1803
• Microsoft Microsoft Windows 10 1809
• Microsoft Windows 10 1903
• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1703
• Microsoft Windows 10 Version 1709
• Microsoft Windows 10 Version 1709 For 32-bit Systems
• Microsoft Windows 10 Version 1803
• Microsoft Windows 10 Version 1809

Weakness classes (CWE)

• CWE-59Improper Link Resolution Before File Access ('Link Following')

  Base

  The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

  Entry at MITRE CWE-59

References & sources

• Microsoft Security Update GuideWindows Elevation of Privilege VulnerabilityVendor advisory, Patch, Vendor advisory
• portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2019-1064x_refsource_MISC, x_transferred, Patch, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1064government-resource, US government resource