CVE-2019-1069
Microsoft Windows 10 1507
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2019-1069 is a high-severity Link Following (CWE-59) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked in the top 7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
An elevation of privilege vulnerability exists in the Windows Task Scheduler Service due to improper validation of certain file operations, tracked as CVE-2019-1069 and assigned CWE-59. The flaw affects the service's handling of file operations on affected Windows systems and carries a CVSS 3.1 score of 7.8 reflecting local attack vector, low complexity, and high impact on confidentiality, integrity, and availability.
An attacker with unprivileged code execution on a victim system can exploit the issue to gain elevated privileges. Successful exploitation requires only local access and no user interaction beyond the initial foothold.
Microsoft security updates address the vulnerability by implementing correct validation of file operations. The flaw appears in the CISA Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation, and has also been discussed in third-party analyses such as 0patch and CERT/CC coordination pages.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-9651
Vulnerability Data
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require…
more
unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.
- CWE(s)
- KEV Date Added
- 15 March 2022
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require code to validate paths and avoid unsafe link following.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.