CISA KEV · Known exploitedHigh

CVE-2021-43890

Microsoft App Installer, app installer, windows 10 1809

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrati...

CVSS: 7.1
EPSS: 10.3%
CISA KEV: Listed
Published: 2021.12.16

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability10.3%

Technical severityCVSS 7.1

Vulnerability overview

Affected product and versions

Product: Microsoft App Installer, app installer, windows 10 1809
Affected versions: >= 1.0.0.0 < publication, < 1.16, < 1.11
Fixed versions: 1.16, 1.11

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2021.12.29

1
Identify
Confirm that Microsoft App Installer, app installer, windows 10 1809 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE: Not available
KEV added: 2021.12.15
Ransomware use: 확인됨