CVE-2019-1405 (Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation)

CVE-2019-1405 is an universal plug and play (UPnP) service privilege escalation vulnerability in Microsoft Windows. CISA added it to the Known Exploited Vulnerabilities catalogue on 15 March 2022, which means attackers have used it in real attacks. A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

What this vulnerability means in practice

CVE-2019-1405 matters because it is not just a bug in a background service, it is a privilege escalation path inside Windows. When an attacker can trigger the Windows UPnP service to create COM objects improperly, they may be able to move from a low-privilege foothold to higher local authority on the host.

That kind of escalation is dangerous because it can turn an otherwise limited compromise into something that can tamper with security tooling, plant persistence, or stage further lateral movement. For defenders, the key question is not only whether the host is patched, but whether any intruder already leveraged the flaw before remediation.

How organisations assess exposure to this CVE

Exposure checking starts with asset inventory, because only systems running the affected Windows service are in scope. Teams should then confirm whether the host is reachable in ways that make exploitation more likely, especially where endpoints are broadly accessible or where attacker footholds already exist.

The safest source of version and remediation detail is the vendor advisory, with the NIST National Vulnerability Database and the CVE Program providing authoritative record context. For prioritisation, treat this as a real exploitation concern rather than a theoretical weakness, because CISA placed it in the KEV catalogue.

Windows privilege escalation issues often sit inside a wider hardening problem, not an isolated defect. The Network Ports and Protocols Security Guide is useful background when reviewing whether unnecessary services, exposed management paths, or weak network segmentation are widening the attack surface around the host.

Remediation and compensating controls

The primary fix is to apply the vendor patch as soon as operationally possible. If patching must be delayed, reduce the number of machines exposed to untrusted users, limit who can log on locally, and harden adjacent controls that make escalation more useful to an attacker.

Where privilege elevation is part of the post-compromise path, least privilege and privilege separation matter immediately. NHIMG’s Privileged Access Management Guide explains why vaulted admin access, just-in-time elevation, and tight session control reduce the impact of a local exploit becoming a full host takeover.

For teams managing many endpoints, the Vulnerability Management Guide is relevant because this CVE should be prioritised through asset criticality, exploit evidence, and remediation tracking rather than by severity alone.

Detection and post-patch compromise review

Detection should assume the attacker may already have used the flaw to gain elevated rights. Review endpoint telemetry for unusual process creation, suspicious service interactions, new local administrators, and signs that a low-privilege account performed actions that normally require elevated permissions.

After patching, perform compromise review on any host that may have been exposed before remediation. That includes checking for persistence, unapproved scheduled tasks or services, and credential theft indicators, because local privilege escalation often becomes a launch point for broader intrusion.

The MITRE ATT&CK Enterprise Matrix helps defenders map observed activity to privilege escalation and follow-on attacker behaviour, while The State of NHI & AI Agent Breach Report 2026 is a useful reminder that once attackers gain higher privilege, credentials and tokens are often among the first assets they target.

Risk and Threat Considerations

Privilege escalation flaws are valuable to attackers because they convert a small initial foothold into higher control over the same machine. In a Windows environment, that can expose secrets, tamper with security tools, and help an intruder persist long enough to pivot elsewhere.

Failure mechanism: The UPnP service improperly allows COM object creation, so an attacker who can execute code locally may abuse that flaw to obtain elevated privileges and extend control beyond the original access level.

Impact: A successful exploit can enable local takeover, defensive evasion, and downstream credential or token access, which increases the chance of lateral movement and broader compromise.

Related resources from NHI Mgmt Group

• CVE-2019-1130 (Microsoft Windows AppX Deployment Service Privilege Escalation)
• CVE-2019-1388 (Microsoft Windows Certificate Dialog Privilege Escalation)
• CVE-2023-28229 (Microsoft Windows CNG Key Isolation Service Privilege Escalation)
• CVE-2023-36874 (Microsoft Windows Error Reporting Service Privilege Escalation)