Windows App Store CVE-2026-42900

Exploitation requires the attacker to reach and repeatedly invoke the Windows App Store / packaged-app (AppX/MSIX) operation path over the network and to reliably win a race condition (CWE-362) - the timing window is the core prerequisite, reflected as AC:H in the CVSS vector. Per the vector, no authentication is required (PR:N) and no user interaction is needed (UI:N), so exploitation is not gated by credentials or a victim click. The principal limiting factor is the high attack complexity: the attacker must repeatedly trigger and interleave concurrent Store operations to hit the vulnerable window, making exploitation unreliable and non-deterministic rather than a single-shot attack. The affected system must be a supported Windows 10/11 or Windows Server 2016-2025 release with the App Store component present and network-reachable.

The signals are mixed. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, unauthenticated flaw with full confidentiality, integrity, and availability impact, which drives the 8.1 (High) base score. However, AC:H is significant: race conditions require the attacker to reliably win a timing window, which lowers real-world exploitability and reliability compared to a straightforward AC:L bug. No EPSS score was provided, so exploitation probability cannot be quantified from this data. It is not in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis - this is not confirmed active exploitation. The combination of network vector with a privilege-elevation outcome is unusual and worth verifying against the vendor advisory: 'elevate privileges over a network' via the App Store implies the attacker interacts with a network-facing Store/activation path rather than a purely local EoP. Net assessment: a genuine High-severity issue worth prioritized patching given ubiquitous Windows deployment, but the AC:H timing requirement and absence of a known exploit place it below a wormable, low-complexity critical.

A remote attacker repeatedly triggers concurrent Windows App Store operations against a target and races to interleave a package activation/authorization step, winning the timing window to bypass an authorization check and act with elevated privileges. Because the CVSS vector is AV:N/AC:H/PR:N/UI:N, no credentials or user interaction are needed, but the attacker must overcome the high-complexity timing requirement to succeed. No public exploit is identified at time of analysis, so any attempt would require the attacker to develop their own reliable race-winning technique.