ZeroDay Findings
Sign inSign up

Findings

CVE-2019-0841

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

Published Apr 9, 2019 · updated Jun 16, 2026 · microsoft windows 10 1703

An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 9, 2019 · Catalog

    Detected

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

  2. Mar 15, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 5, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

Required action

Apply updates per vendor instructions.

CISA due date Apr 5, 2022

Affected

  • cpe microsoft/windows 10 1703version unspecified
  • cpe microsoft/windows 10 1709version unspecified
  • cpe microsoft/windows 10 1803version unspecified
  • cpe microsoft/windows 10 1809version unspecified
  • cpe microsoft/windows server 20161803
  • cpe microsoft/windows server 2019version unspecified
  • vendor Microsoft Windowsversion unspecified

Sources

  • CISA KEVCVE-2019-0841

    A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

    cisa.gov
  • CVE.orgCVE-2019-0841

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2019-0841

    30-day exploitation probability 41.4%

    first.org
  • Exploit Database46683

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database46938

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database46976

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_windows/local/appxsvc_hard_link_privesc

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2019-0841

    An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/152463/Microsoft-Windows-AppX-Deployment-Service-Privilege-Escalation.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/153009/Internet-Explorer-JavaScript-Privilege-Escalation.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/153114/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/153215/Microsoft-Windows-AppX-Deployment-Service-Local-Privilege-Escalation.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com
  • Packet Storm Securityhttp://packetstormsecurity.com/files/153642/AppXSvc-Hard-Link-Privilege-Escalation.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References