Windows AppX Deployment Service: Privilege escalation through incorrect authorization

Summary

Incorrect authorization in the Windows AppX Deployment Service allows a local user with low privileges to gain higher privileges on the affected system. Microsoft rates the flaw Important, with CVSS 7.8 (AV:L/AC:L/PR:L). An attacker needs a valid local account and cannot exploit it remotely, so it is mainly a risk after an initial compromise, for example through phishing or malware.

Affected

• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7711
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870 (fixed build from a third-party source, not verified by the vendor page)

Fixed in

• Install the November 2026 cumulative update from Microsoft for the affected versions.
• The builds listed above are the first fixed builds according to the CVE record. Check the MSRC advisory for the exact KB numbers.

Workaround

Unknown.

Exploitation

• Microsoft's CVSS temporal vector assigns exploit code maturity 'Unproven' (E:U) at release.
• Tenable lists the CVE with 'Exploitation More Likely'.
• Talos reports one vulnerability from the November 2026 release as exploited in the wild, but does not state that it is this CVE. Treat exploitation of this CVE as unconfirmed.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found.

Our recommendation

• Deploy the November 2026 cumulative update to workstations and servers as part of the regular Patch Tuesday cycle.
• Prioritise shared or multi-user systems, RDS/terminal servers and systems where users have local accounts.
• Check whether Windows 10 21H2 and 22H2 systems are still serviced or enrolled in ESU to receive the fix.
• Monitor for signs of local privilege escalation and recheck the exploitation status of this CVE.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC advisory) msrc.microsoft.com
• CVE.org record CVE-2026-116714 www.cve.org
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com
• Talos: Microsoft Patch Tuesday for November 2026 blog.talosintelligence.com
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com
• Third-party CVE aggregator (Server 2022 build, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:03.