CVE-2019-1405VulnerabilityPublished 03/15/2022Updated 10/24/2026

CVE-2019-1405: Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

Affects Microsoft WindowsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/15/2022
KEV deadline: 04/05/2022
Ransomware: Used in ransomware campaigns
EPSS: 30.2% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-1405 (opens in a new tab)

Description

CVE-2019-1405 is a high-severity privilege escalation vulnerability in the Microsoft Windows Universal Plug and Play (UPnP) service. The flaw allows improper creation of COM objects, enabling attackers to escalate privileges on affected systems. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

Summary

This vulnerability arises from the Windows UPnP service improperly allowing the creation of COM objects, which can be exploited to escalate privileges. The issue is tracked as CVE-2019-1405 and has been confirmed as exploited in the wild. The vulnerability affects Microsoft Windows systems running the UPnP service, though exact affected versions are not specified in the provided information.

Impact

Successful exploitation of this vulnerability allows attackers to gain elevated privileges on the affected Windows system. This can lead to unauthorized actions with higher privileges, potentially facilitating further compromise such as ransomware deployment. The vulnerability has been actively exploited in the wild, indicating a tangible threat to affected systems.

Mitigation

Patch status is not yet confirmed — check the Microsoft vendor advisory for current remediation guidance. Until official patches or mitigations are confirmed, organizations should monitor vendor communications and apply updates as soon as they become available. No vendor advisory content or patch links are provided in the current data.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:55:32 UTC

References

Related threats