{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amicrosoftwindows_app_store/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:windows_app_store:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-119987"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows App Store"],"_cs_severities":["high"],"_cs_tags":["windows","privilege-escalation","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eA proof-of-concept (PoC) exploit for CVE-2026-119987 was published on Sploitus on 2026-11-11. The vulnerability affects the Windows App Store and is classified as an Elevation of Privilege flaw with a CVSS 3.1 score of 7.8. The vulnerability allows a low-privileged local user to impact confidentiality, integrity, and availability on the target system.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local attacker to gain elevated privileges on an affected system. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that no user interaction is required, but the attacker must already possess local, low-level access to the machine.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all systems running the Windows App Store and verify that they are up to date with the latest security patches from Microsoft.\u003c/li\u003e\n\u003cli\u003ePrioritize the deployment of patches addressing CVE-2026-119987 across the fleet, starting with multi-user workstations and shared environments.\u003c/li\u003e\n\u003cli\u003eMonitor local system logs for unexpected execution of Windows App Store binaries or suspicious process parent-child relationships initiated by non-administrative users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T02:37:19Z","date_published":"2026-11-11T02:37:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-119987/","summary":"A proof-of-concept exploit has been published for CVE-2026-119987, a high-severity elevation of privilege vulnerability in the Windows App Store that allows local users to gain elevated system access.","title":"Microsoft Windows App Store elevation of privilege (CVE-2026-119987)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-119987/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:microsoft:windows_app_store:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}