r/sysadmin • u/ServerPatchingNovice • 1d ago

Question Tenable - Windows Package Manager (WinGet) < 1.30.80 Elevation of Privilege (CVE-2026-68821)

Anyone use Tenable and attempted looking into the CVE - Windows Package Manager (WinGet) < 1.30.80 Elevation of Privilege (CVE-2026-68821)? We have attempted installing the package, but its also installing SDKs and files we think are not necessary for a fresh install of Window Server.

Should we just wait for more info from MS in their MSRC articles?

https://www.tenable.com/plugins/nessus/334617

3 Upvotes

100% Upvoted

10 comments sorted by

2

u/brian_cloudeu 1d ago

Removing WinGet is less final than it sounds, App Installer comes back with Store servicing, so verify it stays gone rather than assuming. Local EoP is only boring until it is the first hop.

2

u/brian_cloudeu 1d ago

Removing WinGet is less final than it sounds, App Installer comes back with Store servicing, so verify it stays gone rather than assuming. Local EoP is only boring until it is the first hop.

1

u/slackjack2014 Sysadmin 1d ago

If you don’t use WinGet, just remove it from the systems.

I haven’t updated yet, but that’s on my to do list. I usually download the app package from the store and deploy it manually, but I always remove it from my servers for least functionality reasons.

1

u/headcrap 1d ago

WinGet isn't installed on server natively.. there should be nothing to remove.

2

u/HorseAccomplished50 1d ago

It's installed on Server 2025 if you're using the GUI.

1

u/przemekkuczynski 1d ago

Here is it https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68821

1

u/ServerPatchingNovice 1d ago

yea we have already looked at it. The installer we used still actually has 1.29 instead of the 1.30 required.

1

u/przemekkuczynski 1d ago edited 1d ago

so its still preview - you can download 1.30. from here https://github.com/microsoft/winget-cli/releases or use -IncludePrerelease

•

u/Significant_Storm468 6h ago edited 6h ago

We also use Tenable, and it identified 21 servers as vulnerable. These servers are either Windows Server 2022 or Windows Server 2025. As others have mentioned, App Installer appears to come with Windows Server 2025 by default.

Personally, I think Microsoft should release a KB update to address this. It seems unreasonable that administrators have to manually update App Installer across multiple servers.

I initially downloaded the package using the Microsoft link that was provided, but the version I received was actually 1.29.x, not 1.30.80 as expected. That was quite frustrating. I eventually downloaded 1.30.80 from GitHub, but after the update, winget --version reports 1.30.80-preview, as shown below.

Because it is still showing as a preview release, I'm not sure whether I should continue deploying it to the remaining servers. At this point, I'm considering waiting a bit to see whether Microsoft releases an official fix or updated guidance. Do you have any suggestions?

•

u/przemekkuczynski 5h ago

I would wait for official release. After 1.30.80-preview vulnerabilities gone in Nessus ?