CVE-2019-1385

This vulnerability lets a user or attacker who already has an authenticated foothold “step up” to higher privileges than they should have. It can result in accessing system files, like getting behind a locked door to reach the parts of the building only administrators should touch. CISA tied it to ransomware activity, which is why it matters to businesses.

This matters if your business runs Windows 10, Windows Server 2016, or Windows Server 2019. An attacker needs authentication to trigger the privilege escalation by running a specially crafted application, so it’s most relevant where attackers can log in or where credentials are already compromised. If the vulnerable system isn’t reachable by an attacker who can authenticate, the risk is lower—but the KEV/ransomware tie means you should not ignore it.

This is RED because it’s confirmed in CISA KEV and was used in ransomware campaigns. Attackers have a known path to gain higher privileges, making missing patches a direct enabler for compromise. Prioritize patching these Windows systems immediately.

1. Confirm affected systems

   • Inventory all machines running: Windows 10, Windows Server 2016, and Windows Server 2019.
   • Identify whether each machine has the Microsoft security update for CVE-2019-1385 installed (use your patch management/WSUS/SCCM reporting or Windows update history).

2. Determine the correct update for your exact Windows version

   • Use the Microsoft advisory linked from the vendor remediation entry for CVE-2019-1385 and select the update appropriate to your OS version and servicing channel (follow vendor instructions exactly).

3. Patch

   • Install the vendor fix on all identified affected machines.
   • Reboot if your patching process requires it, and ensure the update is recorded as installed.

4. Validate

   • Re-check patch inventory after deployment to ensure no systems remain missing the CVE fix.
   • If you track security baselines, confirm the host no longer appears as non-compliant for CVE-2019-1385.

5. If patching is delayed (temporary containment)

   • Reduce the chance that an attacker can authenticate to affected hosts: tighten account access, disable unused accounts, and ensure MFA is enforced where available.
   • Limit who can run applications and restrict software execution using your standard enterprise controls.
   • Focus monitoring on suspicious signs of AppX-related activity originating from unusual accounts or times.

6. Timing note

   • CISA KEV remediation due date for this CVE was 2022-06-13, so treat any remaining unpatched systems as overdue.

CVE-2019-1385 is a Windows elevation of privilege vulnerability affecting the Windows AppX Deployment Extensions. The flaw is rooted in improper privilege management that can lead to access to system files. Exploitation requires an authenticated attacker to run a specially crafted application. CISA KEV lists this CVE as used in ransomware campaigns (confirmed exploitation), which is why it is treated as actively dangerous rather than theoretical. No public exploit code is recorded. EPSS is a prediction and was reported as low-to-moderate likelihood with a flat trend; however, KEV-confirmed ransomware use overrides reliance on predictions. KEV means the vulnerability has been included in CISA’s Known Exploited Vulnerabilities catalog and organizations are expected to apply vendor remediation guidance.