Microsoft Windows AppX Deployment Extensions: Local privilege escalation

Summary

A missing authorization check (CWE-862) in the Windows AppX Deployment Extensions component allows a local user with low privileges to elevate their rights on the system. Successful exploitation gives an attacker high impact on confidentiality, integrity and availability, with a changed scope (CVSS 3.1: 8.8). The attacker needs a valid local account or a foothold on the device; the flaw cannot be exploited remotely.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2025: 10.0.26100.33650

Fixed in Microsoft's October 2026 security updates. KB article numbers: Unknown.

Workaround

• Installing the October 2026 security update is the fix; no workaround is needed once it is applied.
• Disabling or restricting the AppX Deployment Extensions service where it is not required is suggested by third-party advisories; vendor-specific steps: Unknown.

Exploitation

• Microsoft rates exploit code maturity as Unproven.
• CISA SSVC: Exploitation none, Automatable no; not listed in KEV.
• EPSS about 0.28 percent.
• No public proof-of-concept or in-the-wild exploitation found in limited research.

Our recommendation

• Install the October 2026 cumulative update on all affected Windows 10 and Windows 11 workstations and Windows Server systems via WSUS, Intune or your RMM tool.
• Check first whether any Windows 10 21H2 devices exist; this version is out of mainstream support, so confirm ESU enrolment or plan an upgrade to receive this fix.
• Prioritise shared PCs, unmanaged devices and terminal servers, where a phishing or malware incident could be escalated to full local control.
• Monitor endpoint detection for suspicious privilege changes and re-check the advisory for public exploit code or a KEV listing.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69945 msrc.microsoft.com
• NVD data mirrored by Vulners vulners.com
• OpenCVE: CVE-2026-69945 app.opencve.io
• Strix: CVE-2026-69945 www.strix.ai
• Rapid7 via Vulners: CVE-2026-69945 (EPSS) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:04.