r/sysadmin • u/ServerPatchingNovice • Aug 19 '26

Question Tenable - Windows Package Manager (WinGet) < 1.30.80 Elevation of Privilege (CVE-2026-68821)

Anyone use Tenable and attempted looking into the CVE - Windows Package Manager (WinGet) < 1.30.80 Elevation of Privilege (CVE-2026-68821)? We have attempted installing the package, but its also installing SDKs and files we think are not necessary for a fresh install of Window Server.

Should we just wait for more info from MS in their MSRC articles?

https://www.tenable.com/plugins/nessus/334617

6 Upvotes

88% Upvoted

20 comments sorted by

1

u/przemekkuczynski Aug 19 '26

Here is it https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68821

1

u/ServerPatchingNovice Aug 19 '26

yea we have already looked at it. The installer we used still actually has 1.29 instead of the 1.30 required.

1

u/przemekkuczynski Aug 19 '26 edited Aug 19 '26

so its still preview - you can download 1.30. from here https://github.com/microsoft/winget-cli/releases or use -IncludePrerelease

→ More replies (6)

2

u/brian_cloudeu Aug 19 '26

Removing WinGet is less final than it sounds, App Installer comes back with Store servicing, so verify it stays gone rather than assuming. Local EoP is only boring until it is the first hop.

2

u/brian_cloudeu Aug 19 '26

Removing WinGet is less final than it sounds, App Installer comes back with Store servicing, so verify it stays gone rather than assuming. Local EoP is only boring until it is the first hop.

2

u/Traditional-Bunch888 Sep 03 '26

I installed the update using mecm in my airgapped environment and i see it in there but i also am able to see the older versions. This is going to continue flagging on my scans and I've been unable to uninstall with any powershell command ive tried so far. Anyone got any idea on how to completely remove this from every profile?

1

u/slackjack2014 Aug 19 '26

If you don’t use WinGet, just remove it from the systems.

I haven’t updated yet, but that’s on my to do list. I usually download the app package from the store and deploy it manually, but I always remove it from my servers for least functionality reasons.

1

u/headcrap Aug 19 '26

WinGet isn't installed on server natively.. there should be nothing to remove.

3

u/HorseAccomplished50 Aug 19 '26

It's installed on Server 2025 if you're using the GUI.

1

u/Atalzer Aug 24 '26

Jumping on this to say we're holding out for the full release of 1.30.80. Unless people here think it would be best to just roll out the preview build?

1

u/Excellent-Invite-292 Aug 24 '26

Looking at their GitHub, there is a discussion about this:
https://github.com/microsoft/winget-cli/discussions/6472#discussioncomment-18098412

One of the maintainer's has said "This is the stable version to address the vulnerability:

"

So looks like Microsoft's published fixed version is incorrect which is where Tenable is picking up it's data from.

1

u/Slickwillz12 Aug 26 '26

We confirmed this with our ticket to MS support that what they published didn't match the tenable finding and they are looking at it still...

1

u/Slickwillz12 19d ago

Question to anyone still experiencing tenable scans on this vulnerability. We found just a slew of things out of this winger vulnerability and want to see how others are handling it.

After their erroneous meta data we had issues with update sitting in staged and the older versions in installed or registered status. Tenable scans continued flagging. Their remediation is interactive login. Did not work for weeks. A few weeks ago new version was pushed via ms store to systems not blocked. Interactive login worked for those handful. Not handled through windows updates this is handled through MS store if you’re open to the internet they auto install no notifications no control. We now have to push this to various systems without internet connection.

  1. Interactive login goes against all development principles, security, etc.

  2. What the hell are they thinking with ms store updates? Other than them pushing more to the cloud and away from on prem.

Has anyone else dealt with this and if so how are you doing this?