CVE-2019-1069:

Windows Task Scheduler Elevation of Privilege vulnerability (CVE-2019-1069) enabling local privilege escalation via improper validation of file operations.

Score
A numerical rating that indicates how dangerous this vulnerability is.

7.8High

Published Date:Jun 12, 2019
CISA KEV Date:Mar 15, 2022
Industries Affected:20

Armis Early Warning:

1007 Days

Threat Predictions

EPSS Score:30.1
EPSS Percentile:97%

Exploitability

Score:1.8
Attack Vector:LOCAL
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Windows Task Scheduler Elevation of Privilege vulnerability (CVE-2019-1069) enabling local privilege escalation via improper validation of file operations.

Overview

This CVE-2019-1069 describes a local elevation of privilege flaw in Windows Task Scheduler where the service improperly validates certain file operations. An attacker with unprivileged code execution on a system could exploit this to elevate privileges. The vulnerability is addressed by a security update that corrects the file operation validation in the Task Scheduler service, affecting multiple Windows 10 and Windows Server releases across different architectures.

Remediation

Apply the Microsoft security update for CVE-2019-1069 to all affected Windows 10 and Windows Server systems (including 1703, 1803, 1809, 1903, and corresponding Server releases).
Use Windows Update, WSUS, or SCCM to deploy the patch across endpoints and servers, and reboot if prompted.
Verify patch installation on each system (check for the specific CVE fix or corresponding KB update) and document patch status.
Enable and enforce automatic updates where feasible to ensure ongoing protection.
If patching cannot be applied immediately, implement compensating controls such as limiting untrusted code execution paths, monitoring Task Scheduler activity for anomalous operations, and planning for a rapid deployment once patching becomes possible.
After patch deployment, validate that the vulnerability is mitigated by following Microsoft guidance and performing post-patch testing and monitoring for attempted exploitation.