KB4503267: Windows Server Security Update (June 2019)
A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.
A local attacker, with a low-privilege account, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. CISA has confirmed use of this vulnerability in known ransomware campaigns — treat as high priority for remediation. Federal agencies are required to remediate by 2022-04-05 under CISA BOD 22-01.
This is a Software Vulnerability (CWE-59) (CWE-59) vulnerability in Microsoft Task Scheduler. An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations. Exploitation requires local access, low attack complexity, a low-privilege authenticated account, and no user interaction required.
Probably yes if any of these apply:
Used in known ransomware campaigns. Threat-research write-up: https://blog.0patch.com/2019/06/another-task-scheduler-0day-another.html
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB4503267Manual remediation steps
Apply the Microsoft Security Update
Microsoft has released an official security update that fixes this vulnerability.
Required KB Updates
Supersedes: KB4494440, KB4494441, KB4497936, KB4499154, KB4499167, KB4499179, KB4499181
Affected Products
Installation Methods
Windows Update (recommended)
Microsoft Update Catalog (manual download)
.msu installer with administrator privilegesWSUS / SCCM / Intune
Approve KB4503267 for the affected products in your update management console.
Microsoft Download Center Links
Verification
Confirm the update is installed:
Get-HotFix | Where-Object { $_.HotFixID -in @('KB4503267','KB4503279','KB4503284','KB4503286','KB4503291','KB4503293','KB4503327') }
References
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.