{"id":"CVE-2026-116714","kind":"vulnerability","aliases":["CVE-2026-116714"],"related":[],"title":"Windows AppX Deployment Service lets a local user gain higher privileges","description":"Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.","summary":"Windows AppX Deployment Service checks authorization incorrectly, so a user who already has a local account can elevate their privileges. An attacker who gets a foothold on the machine can gain higher rights, potentially full control of the system.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-server"],"not_affected_if":["no-local-untrusted-users","patched-build"],"how_to_check":"Run 'winver' or PowerShell '[System.Environment]::OSVersion.Version' and compare the build with the fixed builds: Win10 21H2 < 10.0.19044.7846, Win10 22H2 < 10.0.19045.7846, Win11 23H2 < 10.0.22631.7711, Server 2022 < 10.0.20348.5870 means exposed. Also check Windows 11 24H2/25H2 in the MSRC guide, which the mirror does not list.","fix":"Install the November 2026 Windows cumulative update: Win10 21H2/22H2 build 10.0.19044.7846 / 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Server 2022 10.0.20348.5870 (per mirror of Microsoft's record; confirm in MSRC).","status":"open","published_at":"2026-11-10T19:19:13+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","triaged_at":"2026-11-10T19:40:50+00:00","updated_at":"2026-11-10T23:39:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:40:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows AppX Deployment Service lets a local user gain higher privileges","impact":"high","summary":"Windows AppX Deployment Service checks authorization incorrectly, so a user who already has a local account can elevate their privileges. An attacker who gets a foothold on the machine can gain higher rights, potentially full control of the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user escalates to SYSTEM-level control of the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-116714 for affected Windows builds and the patch; the NVD record here gives no versions or fix.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects Windows machines where a local, authorized user can reach the AppX Deployment Service. The sources do not list affected Windows builds or configurations. Systems with only trusted single-user accounts carry lower practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4494,"output_tokens":437,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-116714 for affected Windows builds and the patch; the NVD record here gives no versions or fix.","search":"'-116714':14A,17A '-2026':13A,16A '10':19A,22A '11':25A '2022':29A '21h2':20A '22h2':23A '23h2':26A 'account':54B 'allow':85C 'alreadi':50B 'appx':2A,40B,82C 'attack':60B,88C 'author':44B,79C,87C 'check':43B 'control':74B 'cve':12A,15A 'deploy':3A,41B,83C 'elev':56B,90C 'escal':34B 'foothold':64B 'full':73B 'gain':9A,69B 'get':62B 'higher':10A,70B 'incorrect':45B,78C 'infrastructur':30B 'let':5A 'local':7A,32B,53B,92C 'local-privilege-escal':31B 'machin':67B 'potenti':72B 'privileg':11A,33B,58B,91C 'right':71B 'server':28A,38B 'servic':4A,42B,84C 'system':77B 'user':8A,48B 'window':1A,35B,37B,39B,81C 'windows':18A,21A,24A,27A 'windows-serv':36B","nicknames":[],"mitigations":[],"who_affected":"Windows 10 21H2/22H2, Windows 11 23H2 and Windows Server 2022 below the fixed builds, per the mirrored Microsoft record. Needs an existing low-privileged local account or code execution on the machine, so shared machines, terminal servers, developer workstations and CI Windows runners matter most. Single-user machines with trusted users carry lower practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1021h2","1022h2","1123h2","server2022","windows1021h2","windows1022h2","windows1123h2","windowsserver2022"],"ptokens":["10","11","2022","21h2","22h2","23h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsserver"],"campaign_type":null,"search_a":"'-116714':14A,17A '-2026':13A,16A '10':19A,22A '11':25A '2022':29A '21h2':20A '22h2':23A '23h2':26A 'appx':2A 'cve':12A,15A 'deploy':3A 'gain':9A 'higher':10A 'let':5A 'local':7A 'privileg':11A 'server':28A 'servic':4A 'user':8A 'window':1A 'windows':18A,21A,24A,27A","search_b":"'account':54B 'alreadi':50B 'appx':40B 'attack':60B 'author':44B 'check':43B 'control':74B 'deploy':41B 'elev':56B 'escal':34B 'foothold':64B 'full':73B 'gain':69B 'get':62B 'higher':70B 'incorrect':45B 'infrastructur':30B 'local':32B,53B 'local-privilege-escal':31B 'machin':67B 'potenti':72B 'privileg':33B,58B 'right':71B 'server':38B 'servic':42B 'system':77B 'user':48B 'window':35B,37B,39B 'windows-serv':36B","search_c":"'allow':85C 'appx':82C 'attack':88C 'author':79C,87C 'deploy':83C 'elev':90C 'incorrect':78C 'local':92C 'privileg':91C 'servic':84C 'window':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116714","severity":null,"published_at":"2026-11-10T19:19:13+00:00","modified_at":"2026-11-10T19:19:14+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","fetched_at":"2026-11-10T19:24:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116714:3209","url":"https://www.openadvisories.org/vuln/CVE-2026-116714","severity":null,"published_at":"2026-11-10T23:39:48+00:00","modified_at":"2026-11-10T23:39:48+00:00","first_seen_at":"2026-11-10T23:39:48+00:00","fetched_at":"2026-11-10T23:39:48+00:00","note":"MSRC page is JS-only and not readable here; builds/fixes taken from OpenAdvisories mirror of Microsoft's CNA record (not primary), so nothing marked verified. No exploitation or PoC found. Sibling AppX CVEs (85934, 85849, 69945) are different bugs.","cites":["https://www.openadvisories.org/vuln/CVE-2026-116714"]}],"documents":[{"id":120415,"url":"https://www.openadvisories.org/vuln/CVE-2026-116714","title":"OpenAdvisories: CVE-2026-116714 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}