Cpe:2.3:a:microsoft:windows_app_store:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amicrosoftwindows_app_store/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 02:37:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMicrosoft Windows App Store elevation of privilege (CVE-2026-119987)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-119987/Wed, 11 Nov 2026 02:37:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-119987/A proof-of-concept exploit has been published for CVE-2026-119987, a high-severity elevation of privilege vulnerability in the Windows App Store that allows local users to gain elevated system access.A proof-of-concept (PoC) exploit for CVE-2026-119987 was published on Sploitus on 2026-11-11. The vulnerability affects the Windows App Store and is classified as an Elevation of Privilege flaw with a CVSS 3.1 score of 7.8. The vulnerability allows a low-privileged local user to impact confidentiality, integrity, and availability on the target system.

Impact

Successful exploitation allows a local attacker to gain elevated privileges on an affected system. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that no user interaction is required, but the attacker must already possess local, low-level access to the machine.

Recommendation

  • Inventory all systems running the Windows App Store and verify that they are up to date with the latest security patches from Microsoft.
  • Prioritize the deployment of patches addressing CVE-2026-119987 across the fleet, starting with multi-user workstations and shared environments.
  • Monitor local system logs for unexpected execution of Windows App Store binaries or suspicious process parent-child relationships initiated by non-administrative users.
]]>highadvisorywindowsprivilege-escalationvulnerability