KEV · Actively exploited
CVE-2019-1405
HIGH 7.8
KEV
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
Attack vector : Local
No user interaction
Show raw CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
29.95%
moderate exploit risk
percentile 98.0%
CISA Known Exploited Vulnerability
- Added to KEV
- 2022-03-15
- Remediation deadline
- 2022-04-05
- Required action
- Apply updates per vendor instructions.
- Ransomware
- Yes, known ransomware campaign
OS versions that fix this CVE
This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.
- Windows Server 2019 (Server Core installation) Fixed in —
- Windows Server 2019 Fixed in —
- Windows Server 2016 (Server Core installation) Fixed in —
- Windows Server 2016 Fixed in —
- Windows 10 1903 · 2019-03 Fixed in —
- Windows 10 1809 · 2018-09 Fixed in —
- Windows 10 1803 · 2018-03 Fixed in —
- Windows 10 1709 · 2017-09 Fixed in —
- Windows 10 1607 · 2016-07 Fixed in —