AppX Deployment Service EUVD-2026-99130

Requires pre-existing authenticated local access to the Windows host with at least low privileges (PR:L); the attacker must be able to interact with the AppX Deployment Service locally. There is no remote vector (AV:L) and no user interaction is needed (UI:N), so the primary limiting factor is that the attacker must already have a local foothold on the machine. Impact is limited to integrity (C:N/A:N), meaning the bypass defeats a deployment-related security control rather than exposing data or affecting availability. Exploitation does not depend on a non-default configuration based on available data, but the specific security feature circumvented is not named in the description.

This is a moderate-severity, locally-exploitable security feature bypass in the Windows AppX Deployment Service (CWE-424, improper protection of alternate path). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) shows an authenticated local attacker with low privileges and no user interaction can achieve high integrity impact but no confidentiality or availability loss - consistent with bypassing an integrity/security control rather than stealing data or crashing the system. The signals align toward lower real-world urgency: CISA SSVC rates Exploitation as 'none' and Automatable as 'no', indicating no observed exploitation and no reliable mass-automation path, even though Technical Impact is rated 'total'. No KEV listing and no public exploit are present, so this is not confirmed actively exploited. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. The 'total' technical impact in SSVC appears to reflect the full compromise of the targeted security feature's integrity, not full system takeover, and should be read alongside the C:N/A:N CVSS metrics. Net: a genuine but not high-priority issue - patch in routine cycles, prioritized above cosmetic fixes but below any network-reachable or actively-exploited vulnerability. Note the input tag 'Authentication Bypass' conflicts with the description, which states a general security feature bypass, not specifically authentication - treat the precise security feature affected as unverified pending the Microsoft advisory.

An attacker who already has low-privileged authenticated access to a Windows host (e.g., a standard user account or a foothold from another vulnerability) locally invokes the AppX Deployment Service and abuses an improperly protected alternate path to bypass a security feature that would normally restrict deployment actions. Because no user interaction is required and attack complexity is low, the step is reliable once local access exists, but it cannot be triggered remotely and no public exploit code has been identified.