Microsoft Windows up to Server 2019 Task Scheduler access control

Summaryinfo

A vulnerability, which was classified as critical, was found in Microsoft Windows up to Server 2019. This vulnerability affects unknown code of the component Task Scheduler. Executing a manipulation can lead to access control. This vulnerability appears as CVE-2019-1069. The attack may be performed from remote. In addition, an exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows up to Server 2019 (Operating System). It has been declared as critical. This vulnerability affects some unknown functionality of the component Task Scheduler. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.

The weakness was presented 06/11/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release was coordinated in cooperation with the vendor. This vulnerability was named CVE-2019-1069 since 11/26/2018. The attack can be initiated remotely. A single authentication is required for exploitation. Technical details are unknown but an exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 10/29/2025). The MITRE ATT&CK project declares the attack technique as T1068. The advisory points out:

An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system.

It is declared as attacked. The commercial vulnerability scanner Qualys is able to test this issue with plugin 91544 (Microsoft Windows Security Update for June 2019). This issue was added on 03/15/2022 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 04/05/2022:

Apply updates per vendor instructions.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

See VDB-136349, VDB-136347, VDB-136345 and VDB-136344 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10
• 10 1607
• 10 1703
• 10 1709
• 10 1803
• 10 1809
• 10 1903
• Server 1803
• Server 1903
• Server 2016
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion