HighCISA KEVExploited in the wildPublic exploit

Windows Certificate Dialog Elevation of Privilege

IdentifiersCVE-2019-1388CWE-269· Improper Privilege Management

CVE-2019-1388 is a Windows local elevation of privilege vulnerability in the Windows Certificate Dialog caused by improper enforcement of user privileges. The flaw allows a local attacker to abuse the certificate dialog’s trust and privilege handling to bypass User Account Control boundaries and obtain elevated execution on the affected system. It is commonly referenced as a UAC bypass and has been used as a local privilege escalation technique after initial access.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker with local code execution to elevate privileges on the host, typically moving from a standard user context to a higher-integrity or administrative context. This can enable disabling security controls, credential theft, persistence, lateral movement preparation, and execution of follow-on payloads with elevated rights.

Mitigation

If you can’t patch tonight, do this now.

Until patches are fully deployed, reduce opportunities for local exploitation by limiting local interactive access, restricting execution of untrusted code, enforcing application control, and minimizing membership in local administrator-capable groups. Harden UAC-related workflows, monitor for suspicious elevation attempts involving certificate trust dialogs, and use endpoint protections that detect privilege escalation and UAC bypass behavior. These measures do not replace patching but can reduce exploitability.

Remediation

Patch, then assume compromise.

Apply the Microsoft security updates that address CVE-2019-1388 on affected Windows systems. Ensure operating systems are fully patched with the vendor fix for the Windows Certificate Dialog privilege enforcement issue. Standardize patch management for endpoints and servers to reduce exposure to known local privilege escalation vulnerabilities.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 5 candidates as fakes, detection scripts, or README-only repos.

VALID 0 / 5 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10 1507operating_system

Microsoft CorporationWindows 10 1607operating_system

Microsoft CorporationWindows 10 1709operating_system

Microsoft CorporationWindows 10 1803operating_system

Microsoft CorporationWindows 10 1809operating_system

Microsoft CorporationWindows 10 1903operating_system

Microsoft CorporationWindows 7operating_system

Microsoft CorporationWindows 8.1operating_system

Microsoft CorporationWindows Rt 8.1operating_system

Microsoft CorporationWindows Server 1903operating_system

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Server 2012operating_system

Microsoft CorporationWindows Server 2016operating_system

Microsoft CorporationWindows Server 2019operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberveilleNews

Jul 20, 2026

Base de connaissances offensive sur Windows COM : techniques d'attaque et recherche de zero-days | CyberVeille

A specific Windows UAC bypass vulnerability referenced in the repository as part of COM- and privilege-related offensive techniques.

acronis blogNews

Dec 8, 2025

Makop ransomware: GuLoader and privilege escalation in attacks against Indian businesses

A Windows local privilege escalation vulnerability included in Makop operators’ LPE toolkit to elevate privileges post-compromise.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware1

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2019-1388

NVD

nvd.nist.gov/vuln/detail/CVE-2019-1388

MITRE CWE · CWE-269

Improper Privilege Management

Patch

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388

Third Party Advisory

zerodayinitiative.com/advisories/ZDI-19-975

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1388

Windows Certificate Dialog Elevation of Privilege

IdentifiersCVE-2019-1388CWE-269· Improper Privilege Management