Spoofing Vulnerability in Windows App Installer Affects Microsoft Products
CVE-2026-23656

5.9MEDIUM

Key Information:

Vendor

Microsoft
Status
Windows App Client For Windows Desktop
Vendor
CVE Published:
10 March 2026

What is CVE-2026-23656?

A spoofing vulnerability exists in the Windows App Installer due to insufficient verification of data authenticity. This weakness can allow an unauthorized attacker to execute spoofing attacks over the network, potentially compromising the integrity of data transfers and user trust. Users are advised to monitor updates from Microsoft and apply relevant patches to mitigate any risks associated with this vulnerability.

Affected Version(s)

Windows App Client for Windows Desktop 1.00 < 2.0.964

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.