What’s Vulnerable › Vulnerabilities

CVE-2019-1161: Microsoft Defender Elevation of Privilege Vulnerability

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-08-14 · updated 2026-06-17

Description

An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted command that could exploit the vulnerability and delete protected files on an affected system once MpSigStub.exe ran again. The update addresses the vulnerability and blocks the arbitrary deletion.

Affected products

• Microsoft Forefront Endpoint Protection 2010: all versions
• Microsoft Security Essentials: all versions
• Microsoft System Center Endpoint Protection: 2012, 2012-r2
• Microsoft Windows Defender: all versions
• Microsoft Forefront Endpoint Protection 2010: all versions
• Microsoft System Center 2012 Endpoint Protection: all versions
• Microsoft System Center 2012 R2 Endpoint Protection: all versions
• Microsoft Security Essentials: all versions
• Microsoft System Center Endpoint Protection: all versions
• Microsoft Windows Defender: all versions

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1161
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1161

Get alerted when CVE-2019-1161 or the next vulnerability affects your stack