EUVD-2026-56469
GHSA-j4h5-8p8v-mfj6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector confirmed; low-privilege local account required; no interaction needed; full post-escalation CIA impact; scope unchanged as the escalation targets the same system.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Windows App Installer (the App Installer component of Windows Package Manager, aka winget) allows an authenticated local attacker with standard user privileges to fully compromise confidentiality, integrity, and availability of the affected system. The flaw stems from improper privilege management (CWE-269), meaning the application fails to correctly enforce privilege boundaries during its operations. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as 'none', and EPSS sits at only 0.33% (26th percentile) - but the SSVC technical impact rating of 'total' reflects the severity of a successful local privilege escalation to full system control.
Technical ContextAI
App Installer (CPE: cpe:2.3:a:microsoft:app_installer) is the Windows-native front-end for the Windows Package Manager (winget), responsible for resolving, downloading, and installing application packages on Windows 10 and Windows 11 systems. CWE-269 (Improper Privilege Management) identifies the root cause class: the application does not correctly manage or restrict privilege transitions during its execution flow, allowing a lower-privileged process or user to leverage App Installer's operations to obtain elevated privileges. This class of flaw commonly manifests as insecure use of impersonation tokens, misconfigured COM objects, unprotected named pipes, or unsafe file/registry operations performed at a higher privilege level than warranted. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms exploitation is local, low-complexity, requires only a standard (non-admin) local account, and needs no user interaction, which is consistent with a programmatic privilege escalation path within the application.
RemediationAI
Update App Installer to version 1.30.80 or later, which is confirmed as the patched release per EUVD-2026-56469 affected version data. App Installer can be updated through the Microsoft Store automatically, or administrators can enforce the update via Microsoft Store for Business, Intune, or by deploying the updated .msixbundle package. The Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68821 should be consulted for official deployment guidance. As a compensating control where immediate patching is not feasible, organizations can restrict access to the App Installer executable (AppInstaller.exe) via application control policies (AppLocker or Windows Defender Application Control) for untrusted user groups - note this will prevent those users from using winget entirely, which may impact developer workflows. Disabling the App Installer optional feature via 'Get-AppxPackage *DesktopAppInstaller* | Remove-AppxPackage' is a more aggressive option with the same trade-off.
More in App Installer
View allWe have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Rated high se
Windows App Installer Spoofing Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication re
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today