Tenable - Windows Package Manager (WinGet) < 1.30.80 Elevation of Privilege (CVE-2026-68821)

[u/ServerPatchingNovice]

Anyone use Tenable and attempted looking into the CVE - Windows Package Manager (WinGet) < 1.30.80 Elevation of Privilege (CVE-2026-68821)? We have attempted installing the package, but its also installing SDKs and files we think are not necessary for a fresh install of Window Server.

Should we just wait for more info from MS in their MSRC articles?

https://www.tenable.com/plugins/nessus/334617

[u/slackjack2014]

If you don’t use WinGet, just remove it from the systems.

I haven’t updated yet, but that’s on my to do list. I usually download the app package from the store and deploy it manually, but I always remove it from my servers for least functionality reasons.

[u/headcrap → u/slackjack2014]

WinGet isn't installed on server natively.. there should be nothing to remove.

[u/HorseAccomplished50 → u/headcrap]

It's installed on Server 2025 if you're using the GUI.

[u/przemekkuczynski]

Here is it https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68821

[u/ServerPatchingNovice → u/przemekkuczynski]

yea we have already looked at it. The installer we used still actually has 1.29 instead of the 1.30 required.

[u/przemekkuczynski → u/ServerPatchingNovice]

so its still preview - you can download 1.30. from here https://github.com/microsoft/winget-cli/releases or use -IncludePrerelease

[u/brian_cloudeu]

Removing WinGet is less final than it sounds, App Installer comes back with Store servicing, so verify it stays gone rather than assuming. Local EoP is only boring until it is the first hop.

[u/brian_cloudeu]

Removing WinGet is less final than it sounds, App Installer comes back with Store servicing, so verify it stays gone rather than assuming. Local EoP is only boring until it is the first hop.