Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2019-0543 is a high-severity Improper Authentication (CWE-287) vulnerability in Microsoft Windows 10 1803. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
An elevation of privilege vulnerability exists in Microsoft Windows when the operating system improperly handles authentication requests, as indicated by CWE-287. The flaw affects a broad range of versions including Windows 7, Windows 8.1, Windows 10, Windows RT 8.1, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019.
A local attacker with existing low-privileged access can exploit the issue without user interaction to obtain full elevation of privilege, resulting in high impact to confidentiality, integrity, and availability according to the CVSS 7.8 vector. This allows the attacker to execute arbitrary code or access sensitive resources beyond their original permissions.
Microsoft has published an advisory detailing the vulnerability and associated updates through its security guidance portal. Public exploit code is also available, highlighting the need for prompt patching on affected systems.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-1314
Vulnerability Data
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows…
more
8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- CWE(s)
- KEV Date Added
- 15 March 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects unauthorized successful logons resulting from improper authentication implementations.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Security awareness training instructs users on secure authentication practices and avoiding credential compromise.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.
Session content review can reveal authentication bypasses or failures in session establishment.
Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.
Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
A.5.17 directly mandates generation of non-guessable unique secrets, secure transmission, immediate change of defaults/temporary creds, strong password enforcement, no-reuse, and compromise response, which stops most improper-authentication exploits at source; the bounded remainder is non-password authentication methods and sufficiency-of-proof cases (e.g. IA-2/IA-5 enhancements) left to other controls.
Security requirements specified early and verified through testing drive the consistent implementation of authentication mechanisms, decreasing the likelihood that authentication steps are omitted or incorrectly applied.
A.8.26 explicitly requires identifying and addressing authentication-related requirements (including level of trust in identity via 8.5 and 5.17) as part of application development or acquisition, which prevents a slice of CWE-287 but leaves the dominant sufficiency-of-proof aspects (IA-2/IA-5) and many implementation defects untouched.
A.8.27 mandates security-by-design principles (least privilege, default-deny, never-trust/always-verify, MFA, end-to-end encryption of requests, distrust-external-input, secure session control, and explicit authentication/authorization in every layer), which directly stops most improper-authentication flaws from being exploitable; the bounded remainder is insufficient-proof cases that live only in the strength or correctness of the credential itself (IA-5/IA-2 territory).
A.8.5 directly mandates appropriate-strength authentication techniques, MFA for critical systems, protected log-on procedures, brute-force resistance, no cleartext passwords/transmission, and session controls that stop exploitation of insufficient proof of identity; the bounded remainder is cases where the chosen technique itself is flawed or insufficiently implemented (e.g. weak biometrics without fallback).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.