High‑Severity Privilege Escalation in Microsoft Windows Error Reporting Manager (CVE‑2019‑1315)
What It Is
CVE‑2019‑1315 is a privilege‑escalation flaw in the Windows Error Reporting (WER) manager. The service mishandles hard‑link creation, allowing a low‑privileged user to replace a targeted file with a malicious one and gain elevated rights on the host.
Exploitability
- Public proof‑of‑concept code exists, demonstrating the hard‑link technique.
- No confirmed active‑exploitation campaigns reported to date.
- CVSS v3.1 base score: 7.8 (High), reflecting the ease of local exploitation and impact of full system compromise.
Affected Products
- Microsoft Windows operating systems (all supported editions that include the WER service).
- The vulnerability is addressed by Microsoft security update KB4493472 (released March 2019) and later cumulative patches.
Why It Matters for Compliance & Audit Readiness
Privilege‑escalation pathways undermine access‑control assurances and can invalidate evidence of least‑privilege enforcement—a core requirement in frameworks such as NIST 800‑53 AC‑6, ISO 27001 A.9.2.3, and GDPR’s data‑security obligations. Demonstrating that you have a vendor‑management control (tracking and applying vendor patches promptly) and continuous monitoring (detecting unexpected file changes) provides a defensible audit trail and satisfies due‑diligence expectations for control‑assurance programs.
Recommended Actions
- Verify that the March 2019 (or later) Windows security update is installed on all endpoints.
- Use configuration‑management tools to generate a patch‑compliance report as evidence of due diligence.
- Enable file‑integrity monitoring on directories writable by the WER service to detect unauthorized hard‑link creation.
- Update your privileged‑access‑management (PAM) policies to include regular reviews of local‑admin accounts and enforce “least‑privilege” principles.
- Document the remediation steps in your control‑mapping repository to maintain a clear audit trail.
Source: CISA KEV – CVE‑2019‑1315