CVE-2019-1069

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.

CVSS v3.0 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html	Exploit Third Party Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1069	Patch Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069	Patch Vendor Advisory
https://www.kb.cert.org/vuls/id/119704	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
	cpe:2.3:o:microsoft:windows_server_1803:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1809:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1703:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1709:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1803:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1607:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1507:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1903:-:::::::*
	cpe:2.3:o:microsoft:windows_server_1903:-:::::::*

History

21 May 2025, 18:33

Type	Values Removed	Values Added
References	~~() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1069 -~~	() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1069 - Patch, Vendor Advisory

20 May 2025, 18:15

Type	Values Removed	Values Added
Summary	~~An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations, aka 'Task Scheduler Elevation of Privilege Vulnerability'.~~	An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.
References		() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1069 -

31 Mar 2025, 21:03

Type	Values Removed	Values Added
References	~~(MISC) https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html - Exploit, Third Party Advisory~~	() https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html - Exploit, Third Party Advisory
References	~~(CERT-VN) https://www.kb.cert.org/vuls/id/119704 - US Government Resource, Third Party Advisory~~	() https://www.kb.cert.org/vuls/id/119704 - Third Party Advisory, US Government Resource
References	~~(MISC) https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069 - Patch, Vendor Advisory~~	() https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069 - Patch, Vendor Advisory

19 Sep 2024, 19:58

Type	Values Removed	Values Added
CPE	cpe:2.3:o:microsoft:windows_10:1809:::::::* cpe:2.3:o:microsoft:windows_10:-:::::::* cpe:2.3:o:microsoft:windows_server_2016:1903:::::::* cpe:2.3:o:microsoft:windows_10:1703:::::::* cpe:2.3:o:microsoft:windows_10:1903:::::::* cpe:2.3:o:microsoft:windows_10:1607:::::::* cpe:2.3:o:microsoft:windows_10:1803:::::::* cpe:2.3:o:microsoft:windows_server_2016:1803:::::::* cpe:2.3:o:microsoft:windows_10:1709:::::::*	cpe:2.3:o:microsoft:windows_10_1703:-:::::::* cpe:2.3:o:microsoft:windows_10_1607:-:::::::* cpe:2.3:o:microsoft:windows_server_1803:-:::::::* cpe:2.3:o:microsoft:windows_10_1809:-:::::::* cpe:2.3:o:microsoft:windows_10_1803:-:::::::* cpe:2.3:o:microsoft:windows_10_1903:-:::::::* cpe:2.3:o:microsoft:windows_10_1507:-:::::::* cpe:2.3:o:microsoft:windows_10_1709:-:::::::* cpe:2.3:o:microsoft:windows_server_1903:-:::::::*
First Time		Microsoft windows 10 1709 Microsoft windows 10 1703 Microsoft windows 10 1507 Microsoft windows Server 1903 Microsoft windows 10 1803 Microsoft windows 10 1809 Microsoft windows 10 1903 Microsoft windows Server 1803 Microsoft windows 10 1607

Information

Published : 2019-06-12 14:29

Updated : 2025-05-21 18:33

NVD link : CVE-2019-1069

Mitre link : CVE-2019-1069

JSON object : View

Products Affected

microsoft

windows_10_1507
windows_10_1607
windows_10_1703
windows_10_1709
windows_server_1903
windows_10_1803
windows_server_2016
windows_10_1809
windows_server_1803
windows_10_1903
windows_server_2019

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

7.8 /10