Microsoft Store patch for Paint RCE CVE-2026-83844 bypasses Windows Update

Key facts

The enterprise servicing divide: operating system updates versus modern store apps

Enterprise administrators managing Windows workstation fleets face a critical servicing disconnect following the release of a security patch for CVE-2026-83844, an important remote code execution (RCE) vulnerability in Microsoft Paint. Because modern versions of Windows 10 and Windows 11 decouple traditional inbox utilities into AppX modern store packages, the official remediation is distributed exclusively through the Microsoft Store content delivery network. Standard enterprise patch management channels, including Windows Server Update Services (WSUS), Windows Update for Business (WUfB), and monthly cumulative Patch Tuesday updates, will not deliver or install the fix.

The flaw, tracked as CVE-2026-83844 with a CVSS v3.1 base score of 8.1, stems from an out-of-bounds read condition that allows an unauthenticated network attacker to achieve code execution. Microsoft security documentation states that an adversary could exploit the vulnerability by transmitting a specially crafted packet to an affected service over the network, requiring no user credentials and no victim interaction. However, the operational delivery of the fix has been compromised by a 24-day release delay (derived), undocumented changes to target build numbers, and significant desynchronization between official security advisories and public vulnerability catalog feeds.

Zoom

Comparison of Windows operating system servicing vs decoupled AppX modern app patching

Servicing Dimension	Traditional OS Updates (WSUS / WUfB)	Modern App Packages (Microsoft Store)	Enterprise Vulnerability Impact
Distribution Channel	Cumulative Update (LCU / MSU packages)	Regional Store CDN (displaycatalog.mp.microsoft.com)	Paint receives zero updates via WSUS or Patch Tuesday
Administrative Control	Group Policy rings, mandatory reboot schedules	Intune modern app scan or manual Store trigger	Policies blocking Store disable background security delivery
Workstation Coverage	Machine-wide global system files (system32)	Per-user AppX profiles + provisioned gold image	Auditing active account leaves dormant user profiles vulnerable
Compliance Reporting	Standard WSUS / Intune quality update reports	AppX package query via elevated PowerShell	Workstations report 100% compliant while Paint remains exposed
CVE-2026-83844 Delivery	Not supported ('Customer Action Required: Yes')	Build 11.2609.401.0 released after 24-day lag (derived)	Requires explicit SYSTEM-level WMI scan or fleet removal

For decades, core Windows operating system utilities such as Paint, Notepad, and Calculator were compiled directly into system directories and updated through monolithic monthly Cumulative Updates. In recent Windows 10 and 11 releases, Microsoft transitioned these utilities into modern packaged applications. While decoupling allows independent feature enhancements outside the annual OS upgrade cadence, it fractures enterprise vulnerability remediation.

The ghost build and vulnerability catalog desynchronization

The rollout of the patch revealed a multi-week discrepancy in Microsoft release metadata. When the advisory was published on 13 October 2026, Microsoft designated Paint build 11.2605.91.0 as the minimum fixed version. However, independent investigative testing by systems researcher Brian Vitko of device management firm RFF revealed that build 11.2605.91.0 was never released to the Microsoft Store in any regional market.

Direct queries to the Microsoft Store product catalog API across six major geographic markets (the United States, United Kingdom, Germany, Australia, India, and Singapore) confirmed that the newest available package remained build 11.2605.81.0, a release confirmed to be vulnerable. By 4 November 2026, Microsoft quietly altered its machine-readable October vulnerability feed, replacing the fixed build requirement with 11.2609.401.0 without publishing an advisory revision note.

Zoom

Furthermore, a dangerous desynchronization persists across global vulnerability databases. The official CVE record for CVE-2026-83844 and the National Vulnerability Database (NVD) entry maintained by NIST continue to list Paint versions as affected only below 11.2605.91.0. Commercial vulnerability scanners that synchronize with NVD data feeds will evaluate any endpoint running hypothetical build 11.2605.91.0 as fully mitigated, generating false-negative reports. Endpoints must reach build 11.2609.401.0, which only began populating regional Store catalogs on 6 November 2026, exactly 24 days after disclosure (derived).

Dual-state AppX architecture: per-user profiles and provisioned templates

Auditing and remediating modern AppX applications introduces technical complexities absent in traditional executable patch management. Modern applications in Windows exist across two distinct filesystem layers: per-user package registrations and the machine-wide provisioned package template.

Zoom

Modern store applications are registered independently for each distinct user profile residing on the machine. On shared workstations, shift-worker systems, and laboratory terminals, User A logging in and triggering a Store update will patch their specific package instance. However, dormant user profiles on the same machine retain the older, vulnerable version of the binary. Security checks executed without elevated cross-user parameters only evaluate the active signed-in account, leaving administrators unaware of dormant exposures.

In addition, Windows maintains a global provisioned application image within the Program Files WindowsApps directory. This image acts as a blueprint whenever a new user profile is created on the operating system. If an administrator successfully updates all existing local profiles but fails to update or de-provision the global image, any subsequent domain user logon will immediately unpack and register the vulnerable Paint build from the provisioned template.

Technical auditing and fleet-wide remediation directives

Systems administrators must execute elevated PowerShell commands across their fleet to audit all existing user profiles and the global provisioned template simultaneously. Any endpoint returning a version lower than 11.2609.401.0 remains vulnerable to CVE-2026-83844.

PowerShell commands for auditing, updating, and removing vulnerable Paint packages

Operational Objective	Target Layer	Required PowerShell Administrative Syntax	Execution Context
Audit All User Profiles	Per-User Registrations	Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select Version, Users	Elevated Administrator
Audit Provisioned Blueprint	OS Provisioned Image	Get-AppxProvisionedPackage -Online | Where DisplayName -eq 'Microsoft.Paint'	Elevated Administrator
Trigger MDM Store Scan	Store Catalog Client	Invoke UpdateScanMethod on MDM_EnterpriseModernAppManagement01	NT AUTHORITY\SYSTEM
Purge Attack Surface Entirely	Fleet De-provisioning	Remove-AppxPackage -AllUsers + Remove-AppxProvisionedPackage	Elevated Administrator

Where the Microsoft Store is disabled by organizational policy, administrators should trigger an enterprise store update scan via their Mobile Device Management (MDM) framework by invoking UpdateScanMethod on the Enterprise Modern App Management WMI bridge under SYSTEM context. In environments where enterprise endpoints do not require graphic editing software, administrators should eliminate the network attack surface entirely by purging Paint from all user profiles and removing the provisioned package template.