{"id":"CVE-2026-119987","kind":"vulnerability","aliases":["CVE-2026-119987"],"related":[],"title":"Windows App Store: untrusted search path lets a local user gain higher privileges","description":"Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.","summary":"Microsoft Windows App Store has an untrusted search path flaw that lets an authorized local user elevate their privileges. An attacker who already has a local account can gain higher rights on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","microsoft-store","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-119987\n- Confirm Microsoft Store app updates are current in the Store's Downloads and updates page","fix":null,"status":"open","published_at":"2026-11-10T19:20:23+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","triaged_at":"2026-11-10T19:40:06+00:00","updated_at":"2026-11-10T19:40:06+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows App Store: untrusted search path lets a local user gain higher privileges","impact":"high","summary":"Microsoft Windows App Store has an untrusted search path flaw that lets an authorized local user elevate their privileges. An attacker who already has a local account can gain higher rights on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","microsoft-store","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Fetch the Microsoft Security Update Guide entry for CVE-2026-119987 to confirm affected builds and the patch KB.","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-119987\n- Confirm Microsoft Store app updates are current in the Store's Downloads and updates page","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine with the App Store component can be affected, and the attacker must already be logged in as an authorized user on that machine. Shared workstations, terminal servers and multi-user systems carry the most risk. Single-user machines with trusted accounts have less exposure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4490,"output_tokens":525,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Fetch the Microsoft Security Update Guide entry for CVE-2026-119987 to confirm affected builds and the patch KB.","search":"'-119987':16A,19A '-2026':15A,18A 'account':52B 'allow':68C 'alreadi':48B 'app':2A,28B,66C 'attack':46B,71C 'author':39B,70C 'cve':14A,17A 'elev':42B,73C 'endpoint':20B 'flaw':35B 'gain':11A,54B 'higher':12A,55B 'infrastructur':21B 'let':7A,37B 'local':9A,40B,51B,75C 'machin':59B 'microsoft':23B,26B,64C 'microsoft-stor':22B 'path':6A,34B,62C 'privileg':13A,44B,74C 'right':56B 'search':5A,33B,61C 'store':3A,24B,29B,67C 'untrust':4A,32B,60C 'user':10A,41B 'window':1A,25B,27B,65C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the App Store component can be affected, and the attacker must already be logged in as an authorized user on that machine. Shared workstations, terminal servers and multi-user systems carry the most risk. Single-user machines with trusted accounts have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","high","infrastructure","microsoftstore","windows"],"campaign_type":null,"search_a":"'-119987':16A,19A '-2026':15A,18A 'app':2A 'cve':14A,17A 'gain':11A 'higher':12A 'let':7A 'local':9A 'path':6A 'privileg':13A 'search':5A 'store':3A 'untrust':4A 'user':10A 'window':1A","search_b":"'account':52B 'alreadi':48B 'app':28B 'attack':46B 'author':39B 'elev':42B 'endpoint':20B 'flaw':35B 'gain':54B 'higher':55B 'infrastructur':21B 'let':37B 'local':40B,51B 'machin':59B 'microsoft':23B,26B 'microsoft-stor':22B 'path':34B 'privileg':44B 'right':56B 'search':33B 'store':24B,29B 'untrust':32B 'user':41B 'window':25B,27B","search_c":"'allow':68C 'app':66C 'attack':71C 'author':70C 'elev':73C 'local':75C 'microsoft':64C 'path':62C 'privileg':74C 'search':61C 'store':67C 'untrust':60C 'window':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119987","severity":null,"published_at":"2026-11-10T19:20:23+00:00","modified_at":"2026-11-10T19:20:23+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","fetched_at":"2026-11-10T19:25:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}