CVE-2019-1069
Published 2019-06-12 · Updated 2026-08-12 · Source secure@microsoft.com
Summary
CVE-2019-1069 is a high-severity (CVSS 7.8) vulnerability in Microsoft Task Scheduler. CISA added it to the Known Exploited Vulnerabilities catalog on March 15, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 5, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.
All 390 known-exploited Microsoft vulnerabilities →Description
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Microsoft — Task Scheduler
Name: Microsoft Task Scheduler Privilege Escalation Vulnerability
Date added: 2022-03-15 · Due: 2022-04-05
Required action: Apply updates per vendor instructions.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1069
- https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069
- https://www.kb.cert.org/vuls/id/119704
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1069