CVE-2021-43890Windows AppX Installer Spoofing Vulnerability
Updated under an hour ago ()
Does this affect you?
It affects Microsoft App Installer. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Dec 15, 2021; federal agencies had to remediate by Dec 29, 2021, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. December 27 2023 Update: In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Weakness (CWE)
- Not given
- Known exploited
- Added to CISA KEV Dec 15, 2021; federal remediation due Dec 29, 2021; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 11.29% (percentile 96)
- Assigned by
- microsoft
- NVD analysis
- Analyzed
- Record last updated
- Aug 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Microsoft App Installer microsoft:app_installer | from 1.0.0.0 before publication | CNA record |
microsoft app_installer microsoft:app_installer | before 1.16; before 1.11 | NVD |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43890x-refsource-misc, patch, vendor-advisory
- https://www.bleepingcomputer.com/news/microsoft/microsoft-disables-msix-protocol-handler-abused-in-malware-attacks/press/media-coverage, third-party-advisory
- https://thehackernews.com/2023/12/microsoft-disables-msix-app-installer.htmlpress/media-coverage, third-party-advisory
- https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/exploit, vendor-advisory
- https://github.com/ChrisTitusTech/winutil/pull/26issue-tracking
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43890us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.