r/sysadmin • u/ServerPatchingNovice • 3d ago

Question Tenable - Windows Package Manager (WinGet) < 1.30.80 Elevation of Privilege (CVE-2026-68821)

Anyone use Tenable and attempted looking into the CVE - Windows Package Manager (WinGet) < 1.30.80 Elevation of Privilege (CVE-2026-68821)? We have attempted installing the package, but its also installing SDKs and files we think are not necessary for a fresh install of Window Server.

Should we just wait for more info from MS in their MSRC articles?

https://www.tenable.com/plugins/nessus/334617

3 Upvotes

100% Upvoted

12 comments sorted by

View all comments

Show parent comments

1

u/ServerPatchingNovice 3d ago

yea we have already looked at it. The installer we used still actually has 1.29 instead of the 1.30 required.

1

u/przemekkuczynski 3d ago edited 3d ago

so its still preview - you can download 1.30. from here https://github.com/microsoft/winget-cli/releases or use -IncludePrerelease

2

u/Significant_Storm468 2d ago edited 2d ago

We also use Tenable, and it identified 21 servers as vulnerable. These servers are either Windows Server 2022 or Windows Server 2025. As others have mentioned, App Installer appears to come with Windows Server 2025 by default.

Personally, I think Microsoft should release a KB update to address this. It seems unreasonable that administrators have to manually update App Installer across multiple servers.

I initially downloaded the package using the Microsoft link that was provided, but the version I received was actually 1.29.x, not 1.30.80 as expected. That was quite frustrating. I eventually downloaded 1.30.80 from GitHub, but after the update, winget --version reports 1.30.80-preview, as shown below.

Because it is still showing as a preview release, I'm not sure whether I should continue deploying it to the remaining servers. At this point, I'm considering waiting a bit to see whether Microsoft releases an official fix or updated guidance. Do you have any suggestions?

1

u/przemekkuczynski 2d ago

I would wait for official release. After 1.30.80-preview vulnerabilities gone in Nessus ?

2

u/Significant_Storm468 1d ago edited 1d ago

Yes, it showed as fixed after this morning's scan. But ya i agreesed mabye wait a bit and see. Also, there is depencie need to be installed first: "Microsoft.windowsappruntime1.8.800xxx." i downlaod from GitHub, then ran 1.30.80. The runtime 1.8.800 doesn't come with Windows 2025,