KB4503267: Windows Server Security Update (June 2019)
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
A local attacker, with a low-privilege account, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. CISA has confirmed use of this vulnerability in known ransomware campaigns — treat as high priority for remediation. Federal agencies are required to remediate by 2022-04-05 under CISA BOD 22-01.
This is a Software Vulnerability (CWE-59) (CWE-59) vulnerability in Microsoft Windows. An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links. Exploitation requires local access, low attack complexity, a low-privilege authenticated account, and no user interaction required.
Probably yes if any of these apply:
CISA confirms this CVE has been used in known ransomware campaigns. Added to the KEV catalog on 2022-03-15; federal agencies required to remediate by 2022-04-05.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB4503267Manual remediation steps
Apply the Microsoft Security Update
Microsoft has released an official security update that fixes this vulnerability.
Required KB Updates
Supersedes: KB4494440, KB4494441, KB4497936, KB4499167, KB4499179, KB4499181
Affected Products
Installation Methods
Windows Update (recommended)
Microsoft Update Catalog (manual download)
.msu installer with administrator privilegesWSUS / SCCM / Intune
Approve KB4503267 for the affected products in your update management console.
Microsoft Download Center Links
Verification
Confirm the update is installed:
Get-HotFix | Where-Object { $_.HotFixID -in @('KB4503267','KB4503279','KB4503284','KB4503286','KB4503293','KB4503327') }
References
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.