CVE-2026-85849
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker with valid credentials could exploit this flaw to gain higher privileges on the system, potentially leading to full workstation compromise.
Recommendation
Apply Microsoft security updates for Windows as soon as possible and restrict local access to trusted users.
Other vulnerabilities in Windows AppX Deployment Service
See all- CVE-2019-1130HighActively exploited
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker could exploit this to gain elevated privileges on the system.
- CVE-2019-1129HighActively exploited
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.
- CVE-2019-1064HighActively exploited
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context, then install programs; view, change or delete data. To exploit, the attacker must first log on to the system and run a specially crafted application. The security update addresses the vulnerability by correcting how AppXSVC handles hard links.
- CVE-2019-0841HighActively exploited
An elevation of privilege vulnerability in Windows AppX Deployment Service (AppXSVC), due to improper handling of hard links. A local attacker could exploit this to gain elevated privileges.
- CVE-2026-85934High
Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
- CVE-2026-69979Medium
Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.
- CVE-2026-69969Medium
Improper link resolution before file access (link following) in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
- CVE-2026-69914Medium
An out-of-bounds read vulnerability in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
- CVE-2026-69905Medium
Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.
- CVE-2026-49803High
A race condition in the Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS