CVE-2019-0841

CVE-2019-0841 is a local privilege escalation flaw in the Windows AppX Deployment Service (AppXSVC), which handles deployment of packaged (AppX) applications. The service improperly handles hard links (CWE-59), letting a local attacker manipulate hard links so that AppXSVC performs file operations in protected locations with elevated rights. A successful exploit allows the attacker to run processes in an elevated context — effectively administrative/SYSTEM privileges — which ransomware operators have used in chained attacks. Any unpatched Microsoft Windows system is potentially affected; the available data lists only 'Microsoft Windows' without specific version ranges, so defenders should consult Microsoft's advisory for exact affected releases. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, and EPSS assigns a 41.4% probability of exploitation within 30 days (99th percentile), although no public proof-of-concept is catalogued.

What to do: Apply Microsoft's Windows cumulative updates per vendor instructions as the KEV required action, prioritizing systems where users can log on locally, since exploitation requires local access; the fix shipped in Microsoft's April 2019 security release, so confirm no hosts remain on older builds. Because ransomware operators chain this local privilege escalation, verify patch status across the estate with your inventory tooling and monitor for unexpected elevation or hard-link manipulation on AppXSVC as interim risk reduction.