CVE-2019-1129

An elevation of privilege flaw exists in the Windows AppX Deployment Service (AppXSVC), which improperly handles hard links (CWE-59, improper link resolution before file access), causing file operations to target an unintended path. A local attacker with limited privileges can trigger the mishandled hard-link processing without user interaction and elevate to higher privileges, gaining broad read, write, and modify capabilities at an elevated context. The issue, rated 7.8 High with a local attack vector, affects Windows 10 versions 1703 through 1903 and Windows Server 1803, 1903, and 2019. It was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-15 with known ransomware use, indicating exploitation in the wild, though no public proof-of-concept is known. Defenders should prioritize remediation given its documented role in ransomware operations.

What to do: Apply Microsoft's security updates for each affected Windows build per vendor instructions, as required by CISA's KEV catalog. Because Windows 10 1703–1903 and Windows Server 1803/1903 builds are now out of support, upgrade those systems to a currently supported, fully patched Windows release. Given known ransomware use, prioritize user-facing and internet-reachable endpoints in patch triage and inventory your environment for any remaining legacy builds.