HowToFixMe
● High · CVSS 7.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2019-1253: Improper Link Resolution Before File Access in Microsoft Windows

⚡ At a glance
SeverityCVSS 3.1 base 7.8 (High) · AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vectorLocal. The attacker must already be able to run code on the machine as a low-privileged user.
Actively exploited?Yes, in CISA KEV since 2022-03-15 (federal remediation due 2022-04-05). The record does not flag known ransomware use.
Affected componentWindows AppX Deployment Server (AppXSvc) on Windows 10 (1703, 1709, 1803, 1809, 1903) and Windows Server (1803 Core, 2019, 2019 Core, 1903 Server Core), across 32-bit, x64, and ARM64 builds
Fixed inThe September 2019 Patch Tuesday cumulative update for each affected Windows build. Microsoft did not publish a standalone version string; install the KB tied to your build from the MSRC advisory or the Microsoft Update Catalog.
Type (CWE)CWE-59: Improper Link Resolution Before File Access (link following / junction abuse). An elevation-of-privilege flaw, not remote code execution.

Exploitation status

CVE-2019-1253 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . The CISA SSVC assessment marks exploitation as active with a total technical impact, though it rates the flaw as not automatable because the attacker needs prior local code execution. The KEV entry does not flag this CVE as used in known ransomware campaigns, so I will not claim that here.

Public exploit availability: a working proof-of-concept for the AppXSvc junction abuse is published on Packet Storm (the AppXSvc 17763.1 privilege-escalation write-up listed below). Combined with the KEV listing, treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

Actively exploited. Listed in the CISA Known Exploited Vulnerabilities catalog since 2022-03-15; federal civilian agencies had to remediate by 2022-04-05. This is a local elevation-of-privilege flaw, so the real risk is a foothold turning into SYSTEM. Patch every affected workstation and server on an emergency cycle, not just internet-facing hosts.

What is CVE-2019-1253?

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.

The flaw lives in the AppX Deployment Service, the Windows service (display name AppXSvc) that stages and installs Microsoft Store / UWP packages. It handles certain filesystem paths without properly resolving NTFS junctions, the directory equivalent of a symbolic link. A local attacker who can already run code as a normal user plants a crafted junction so that when AppXSvc, running as SYSTEM, follows the link and writes or deletes a file, the operation lands on a target the user could never touch on their own. That arbitrary write or delete under SYSTEM is what gets turned into full local administrator. This is the classic Windows link-following EoP pattern, and CWE-59 names it precisely.

Two things matter for how you treat this. First, the attack vector is local (AV:L): nobody breaks in over the network with this bug alone. It is the second stage an attacker reaches for after phishing, a malicious document, or a foothold on a shared terminal server. Second, the impact is total once it fires, confidentiality, integrity, and availability all rated HIGH, because SYSTEM owns the box. The fix is to install the September 2019 cumulative update for your specific Windows build, which corrects how AppXSvc resolves those paths.

Identify

Every supported Windows 10 and Windows Server build that shipped before the September 2019 Patch Tuesday ran a vulnerable AppXSvc. Check whether the host is patched rather than guessing from the marketing version. Run this in an elevated PowerShell prompt to list the most recent updates and the OS build:

# Current OS build (e.g. 10.0.17763.x for 1809, 10.0.18362.x for 1903)
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').'CurrentBuildNumber'

# Installed security updates, newest first
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 20

If the newest cumulative update on the box predates September 2019, or you do not see the KB that Microsoft lists for your build on the MSRC advisory, treat the host as vulnerable. The advisory is the authoritative source for the exact KB number per build, because each Windows release (1703, 1709, 1803, 1809, 1903) received its own cumulative update.

How to fix CVE-2019-1253

There is one real fix: install the Microsoft security update for your Windows build. This is a Windows-only flaw in a Windows service, so there are no apt, dnf, winget, or package-manager commands that apply. Pick whichever delivery path matches how you manage your fleet.

Path 1: Windows Update (single machine)

On a standalone workstation or server, the cumulative update arrives through Windows Update. Force a scan and install from an elevated PowerShell prompt:

# Native Update Orchestrator: scan, download, install
UsoClient.exe StartScan
UsoClient.exe StartDownload
UsoClient.exe StartInstall

# Then reboot to finalise; AppXSvc is replaced on restart
shutdown.exe /r /t 60 /c "Reboot to finalise the CVE-2019-1253 security update"

Path 2: WSUS, Configuration Manager, or Intune (fleet)

For managed estates, approve the September 2019 (or any later) cumulative update for each affected build in your patch tool and let the agents pull it:

Path 3: Manual MSU from the Microsoft Update Catalog (offline / air-gapped)

For an isolated host, download the exact KB for your build (find the KB number on the MSRC advisory for CVE-2019-1253), then apply the standalone .msu package:

# Look up your build's KB at:
# https://www.catalog.update.microsoft.com   (search the KB number from the MSRC advisory)
# Example shape only; substitute the real KB filename you downloaded:
$msu = "$env:USERPROFILE\Downloads\windows10.0-kbNNNNNNN-x64.msu"
wusa.exe $msu /quiet /norestart
shutdown.exe /r /t 60 /c "Reboot to finalise CVE-2019-1253 patch"

Confirm the update took

After the reboot, check that the cumulative update is present and the build number moved forward:

# The KB you installed should appear at the top
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID, InstalledOn -First 5

# Build number should match (or exceed) the patched build for your release
[System.Environment]::OSVersion.Version

If you can't patch immediately

Because this is a local elevation-of-privilege bug, firewall rules and network segmentation do nothing for it: the attacker is already on the box. Do not waste a change window blocking ports 443 or 3389; that does not touch AppXSvc. The honest answer is that there is no supported configuration toggle that closes the junction-handling flaw without the patch. What you can do is shrink the blast radius until the update lands:

# Optional, server hardening only; verify nothing depends on AppXSvc first
Stop-Service AppXSvc -Force
Set-Service AppXSvc -StartupType Manual

Treat any of these as a stopgap measured in days, not a substitute for the cumulative update.

Resolve

  1. Re-run the verification commands above. The KB for your build must be present and the OS build number must match the patched build on the MSRC advisory.
  2. Re-run an authenticated vulnerability scan (Nessus, Qualys, OpenVAS, Microsoft Defender Vulnerability Management) against the host. CVE-2019-1253 must no longer be flagged.
  3. Because exploitation is active in the wild, hunt for prior abuse: review AppXSvc-related activity and unexpected SYSTEM-level file writes, and check for suspicious junctions or new local administrators created before the patch timestamp. Treat any hit as a possible compromise: isolate the host, rotate credentials it could reach, and run full IR triage.
  4. If you disabled AppXSvc as a stopgap, decide whether to restore it (Set-Service AppXSvc -StartupType Manual and start on demand) now that the patch is in, and record the change in your CMDB.

Is CVE-2019-1253 being exploited right now?

Yes. It has been in the CISA Known Exploited Vulnerabilities catalog since 2022-03-15, listed as the Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability, and the CISA SSVC assessment marks exploitation as active. CISA only adds CVEs with confirmed real-world exploitation.

Is CVE-2019-1253 remote code execution?

No. It is a local elevation-of-privilege flaw (CWE-59, improper link resolution). The CVSS vector is AV:L, meaning the attacker must already be able to run code on the machine. They use this bug to jump from a normal user to SYSTEM, not to break in from outside.

What is the fixed version, and which KB do I install?

Microsoft fixed this in the September 2019 Patch Tuesday cumulative update. There is no single version string; each Windows build (1703, 1709, 1803, 1809, 1903) and each Windows Server release got its own KB. Look up the KB for your exact build on the MSRC advisory for CVE-2019-1253, or just apply any cumulative update from September 2019 onward, since the fix carries forward.

Is CVE-2019-1253 used by ransomware?

The CISA KEV record for this CVE does not flag it as used in known ransomware campaigns. It is confirmed actively exploited and that alone is reason to patch on an emergency cycle, but do not let anyone tell you the catalog ties it to ransomware. It does not.

Will blocking firewall ports protect me until I patch?

No. This is a local privilege-escalation bug; the attacker is already running code on the host. Firewall and segmentation changes do not affect AppXSvc. The only real fix is the cumulative update; the stopgaps that help are application allow-listing and, on servers with no Store-app need, disabling AppXSvc after testing.

References

This guide was assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Other CVEs touching related code paths, worth patching together with this one:

People also ask

Is CVE-2019-1253 being exploited right now?

Yes. It has been in the CISA Known Exploited Vulnerabilities catalog since 2022-03-15, listed as the Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability, and the CISA SSVC assessment marks exploitation as active. CISA only adds CVEs with confirmed real-world exploitation.

Is CVE-2019-1253 remote code execution?

No. It is a local elevation-of-privilege flaw (CWE-59, improper link resolution). The CVSS vector is AV:L, base score 7.8, meaning the attacker must already be able to run code on the machine. They use this bug to jump from a normal user to SYSTEM, not to break in from outside.

What is the fixed version, and which KB do I install?

Microsoft fixed this in the September 2019 Patch Tuesday cumulative update. There is no single version string; each Windows build (1703, 1709, 1803, 1809, 1903) and each Windows Server release got its own KB. Look up the KB for your exact build on the MSRC advisory for CVE-2019-1253, or apply any cumulative update from September 2019 onward, since the fix carries forward.

Will blocking firewall ports protect me until I patch?

No. This is a local privilege-escalation bug; the attacker is already running code on the host. Firewall and segmentation changes do not affect AppXSvc. The only real fix is the cumulative update; the stopgaps that help are application allow-listing and, on servers with no Store-app need, disabling AppXSvc after testing.