Microsoft Paint RCE Patch Bypasses Windows Update, Requiring Manual Action
Written by AI from the linked story. Not reviewed by an editor. How this works
A critical remote code execution vulnerability in Windows Paint (CVE-2026-83844, CVSS 8.1) exposes systems to network-based attacks requiring no user interaction—a particularly dangerous threat profile. Microsoft chose to distribute the fix exclusively through the Microsoft Store rather than Windows Update, breaking the standard automated patching workflow that most organizations rely on. This means that even diligent IT teams with fully automated Windows Update policies are unknowingly leaving systems unpatched. The incident highlights a growing risk when vendors use fragmented update delivery channels, as security teams cannot assume a single patching pipeline covers all installed software.
Tactical Insight
Immediate actions
- Manually verify and update Microsoft Paint to build 11.2609.401.0 or later via the Microsoft Store across all user accounts and provisioned device copies.
- Run an authenticated vulnerability scan across your entire estate to identify all systems still running vulnerable Paint builds below the patched version.
Long-term improvements
- Expand software inventory and patch tracking to explicitly include Microsoft Store applications, not just traditionally managed Windows components.
- Establish a process to monitor vendor security advisories for non-standard patch delivery channels and incorporate them into your patch management workflow.
- Implement network-level controls (e.g., micro-segmentation or host-based firewalls) to restrict unnecessary inbound network access, reducing exposure to network-based RCE exploits.
Detection measures
- Deploy endpoint detection rules that alert on anomalous process execution originating from Paint or similar low-privilege graphical applications.
- Continuously audit installed application versions using an endpoint management platform (e.g., Intune, SCCM) to flag devices where Microsoft Store apps have not received recent updates.