CVE-2019-0543

CVE-2019-0543 is an elevation-of-privilege flaw (CWE-287, improper authentication) that exists when Windows improperly handles authentication requests, affecting Windows 7, 8.1, RT 8.1, Windows 10 builds 1507 through 1809, and Windows Server 2008 through 2019. A local attacker who can already execute low-privileged code on a target machine can trigger the mishandled authentication handling with no user interaction and no special conditions (CVSS:3.1 AV:L/AC:L/PR:L/UI:N). Successful exploitation yields full control of the local system, with high confidentiality, integrity, and availability impact, so it is typically chained after an initial foothold such as phishing or malware. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-03-15 and notes known ransomware use; a public proof of concept is available (Exploit-DB 46156), and EPSS estimates a ~4.7% chance of exploitation in the next 30 days (91st percentile).

What to do: Apply Microsoft's January 2019 Patch Tuesday security updates (or any later cumulative update) across all affected Windows 7, 8.1, and 10 clients and Windows Server 2008-2019 hosts; organizations on Windows 7/Server 2008 R2 need Extended Security Update (ESU) coverage if still unpatched. Prioritize domain controllers, file servers, and internet-facing endpoints given the CISA KEV listing and known ransomware use, and since this is a post-foothold privilege escalation, also verify the initial-access vector (RCE/phishing) is remediated and monitor for local privilege-escalation activity.