CVE-2019-1405

A Microsoft Windows UPnP service vulnerability allowed privilege escalation, actively exploited and linked to ransomware attacks.

The UPnP service's improper COM object creation allowed attackers to escalate privileges, potentially granting them unauthorized access and control. DIB organizations using vulnerable Windows systems face increased risk of ransomware infection and compliance failures (e.g., NIST 800-171 controls related to access control and malware protection); immediate patching is critical.

Shame score — A widely-used service with a privilege escalation vulnerability actively exploited in ransomware campaigns demonstrates a significant failure in Microsoft's security practices.