What is the CVSS score of CVE-2026-42900?

CVE-2026-42900 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Windows App Store are affected by CVE-2026-42900?

A privilege escalation vulnerability in the Windows App Store component (CVE-2026-42900, CVSS 8.1) affects millions of Windows 10, 11, and Server systems globally, allowing unauthenticated remote…. A patch is available.

How to fix or mitigate CVE-2026-42900?

Within 24 hours, inventory all affected Windows 10 (versions 1607-26H1), Windows 11, and Windows Server (2016-2025) systems and assess network exposure. Microsoft has released a security patch; within 7 days, deploy this patch to all affected endpoints, prioritizing internet-facing and critical systems. Within 30 days, validate patch deployment across your environment using tools like SCCM or Intune, confirm no unpatched systems remain, and document completion for audit purposes.

Windows App Store CVE-2026-42900

EUVD-2026-43970 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-mcvx-hvv7-4q3h

Authentication Bypass Race Condition Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

8.1

CVSS 3.1 · Vendor: microsoft

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.1 HIGH

cvss

vuln.today AI

8.1 HIGH

Race condition gives AC:H; description states network vector and unauthorized (unauthenticated) attacker so AV:N/PR:N/UI:N; privilege elevation yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:36 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 8.1

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in the Windows App Store component affects a broad range of Microsoft Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2016 through 2025), where a race condition (CWE-362) lets an unauthorized attacker win a timing window to gain elevated privileges over a network. The CVSS 3.1 score is 8.1 with a network vector and no authentication (PR:N), but high attack complexity (AC:H) reflects the difficulty of reliably winning the race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available from Microsoft.

Technical ContextAI

The flaw is a concurrency defect (CWE-362, 'Concurrent execution using shared resource with improper synchronization') in the Windows App Store subsystem, the platform service that handles installation, updating, and activation of packaged (MSIX/AppX) applications. A race condition arises when two or more execution threads access a shared resource without adequate locking, so an attacker who can influence timing may interleave operations to reach a state the developers assumed was atomic - here, a state that results in improper privilege assignment. The CPE data enumerates the affected platforms as Microsoft application-level components across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016/2019 (including Server Core), with tags extending coverage to Windows Server 2022 and 2025. The 'Authentication Bypass' tag combined with CWE-362 suggests the race is exploited to bypass an authorization/authentication check during a Store operation.

RemediationAI

Apply the Microsoft security update for CVE-2026-42900 as the primary fix: Patch available per vendor advisory (Microsoft), documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42900 - install the corresponding monthly cumulative update for each affected Windows 10, Windows 11, and Windows Server build, as exact fixed build numbers are enumerated per OS in the MSRC entry. No exact fixed version string was provided in this dataset, so confirm the precise KB/build from MSRC before deployment. If patching must be staged, prioritize network-exposed and multi-user systems, and as a compensating control restrict network access to the affected hosts and monitor for anomalous App Store / AppX package installation and activation activity; note that constraining Store functionality via policy may disrupt legitimate packaged-app deployment and update workflows, so validate impact before enforcing.