Microsoft Windows App Store: Untrusted search path enables local privilege escalation

Summary

The Microsoft Windows App Store component contains an untrusted search path vulnerability (CWE-426). A local user with a low-privileged account can exploit it to gain higher privileges on the system. The attack requires local access and does not expose the component to the internet. The CVSS base score is 7.8 (High).

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to < 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to < 10.0.26100.33650

Server coverage is taken from the CVE record and is not yet confirmed by a second source.

Fixed in

• Fixed in the build at the upper bound of each affected range, for example 10.0.19044.7807 for Windows 10 Version 21H2 and 10.0.26100.33650 for Windows Server 2025.
• Confirm the KB article numbers on the MSRC advisory page before deploying.

Workaround

Unknown.

Exploitation

• A public proof-of-concept is listed on Sploitus, dated 2026-11-11. Its code rating is low (33% confidence), and it has not been verified.
• Exploitation in the wild: Unknown.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.

Our recommendation

• Install the November 2026 Windows security update on all affected systems through Windows Update or WSUS.
• Prioritise shared PCs, terminal servers and workstations with several local user accounts.
• Limit local logons and standard-user rights where possible.
• Monitor for unusual privilege changes or new processes started by standard users.
• Check the MSRC advisory and NVD once the analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  karollooool/CVE-2026-119987-writeup

Research sources

• Microsoft Security Update Guide: CVE-2026-119987 msrc.microsoft.com
• Strix: CVE-2026-119987 www.strix.ai
• Sploitus: exploit entry for CVE-2026-119987 sploitus.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• PremierePC: Windows App Store elevation of privilege premierepc.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:34.