Microsoft Windows AppX Deployment Service: Local privilege escalation via link following
Summary
A link-following weakness (CWE-59) in the Windows AppX Deployment Service allows a locally authorized user to gain higher privileges. An attacker first needs a low-privileged account on the system, for example after a phishing compromise, and can then gain SYSTEM rights. The attack is local only, requires high complexity, and is most relevant on shared PCs and terminal servers.
Affected
- Windows 10 Version 1607: before 10.0.14393.9688
- Windows 10 Version 1809: before 10.0.17763.9487
- Windows Server 2016 (including Server Core): before 10.0.14393.9688
- Windows Server 2019 (including Server Core): before 10.0.17763.9487
- The full product list is not confirmed in the retrieved data; Windows 11, Windows 10 22H2 and Server 2022/2025 were not visible. Check the MSRC entry.
Fixed in
- Cumulative update of November 2026 for each affected build (KB number: Unknown; verify on MSRC)
Workaround
Unknown.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept known.
- Microsoft rates exploit code maturity as unproven (E:U).
Our recommendation
- Apply the November 2026 cumulative update to all affected Windows 10 1607/1809 and Windows Server 2016/2019 systems; verify the KB number on the MSRC page.
- Prioritise shared, multi-user, terminal server and RDS systems.
- Check whether older builds are still supported and plan upgrades where they are not.
- Monitor for unexpected privilege changes and new local administrator accounts.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows AppX Deployment Service
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-88224 msrc.microsoft.com
- CVE Record CVE-2026-88224 www.cve.org
- Rapid7: November 2026 Patch Tuesday www.rapid7.com
- Qualys: Microsoft Patch Tuesday November 2026 blog.qualys.com
- Strix AI: CVE-2026-88224 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:13.
Original description (NVD)
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.