Threadlinqs IntelligenceStart free

VulnerabilityCVE-2019-0986Published 2019-06-12

CVE-2019-0986 — Microsoft Windows 10 Version 1703

mediumPublic exploit2 PoC repos

As of 2025-05-20, CVE-2019-0986 is a MEDIUM-severity vulnerability in Microsoft Windows 10 Version 1703, CVSS v3.1 6.3, EPSS 2.0% (80.8th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2019-0986, most recently “LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day PoC Released by Nightmare-Eclipse”.

CVSS v3.1
6.3/10Medium
EPSS
2.0%Higher than 80.8% of scored CVEs
CISA KEV
NoNot in the KEV catalog
Tracked threats
1Campaigns referencing it
Priority
8.4/10Threadlinqs triage score
Published
Updated 2025-05-20
CVSS v3.1 6.3 (MEDIUM) · EPSS 2.0% (higher than 80.8% of all scored CVEs) · Priority 8.4/10 · Published 2019-06-12

Last updated:

What is CVE-2019-0986?

An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and delete files or folders of their choosing. The security update addresses the vulnerability by correcting how the Windows User Profile Service handles symlinks.

Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on integrity, availability. 12 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 2695 days ago.

Severity and exploitation probability

CVSS v3.1 base score
6.3 — MEDIUM
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
EPSS (FIRST)
2.0% probability of exploitation in the next 30 days, higher than 80.8% of all scored CVEs
CISA KEV
Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority
8.4/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published
2019-06-12, last modified 2025-05-20

Is CVE-2019-0986 being exploited?

Weaponised exploit code for CVE-2019-0986 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 33 in the Threadlinqs vulnerability feed.

Affected products and versions

  • Microsoft: Windows 10 Version 1703, Windows 10 Version 1803, Windows Server, version 1803 (Server Core Installation), Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1709 for 32-bit Systems, Windows 10 Version 1709, Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation)

How to fix CVE-2019-0986

No vendor patch reference has been recorded for CVE-2019-0986 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2019-0986

1 tracked threat in the Threadlinqs corpus references CVE-2019-0986, either in the campaign’s CVE list or as an indicator on the campaign record.

Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on .

Vendor advisory and patch