[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7z-EMzgH55_cAMtPokOxyRy41iS85lixdCUbd4gDUaQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"b97b6279-ae5c-4ff4-b92f-9efa9e300ffb","microsoft-paint-rce-patch-bypasses-windows-update-requiring-manual-action","005ad9c3-ab88-4f7f-b335-f1666d53f5e9","Microsoft Paint RCE Patch Bypasses Windows Update, Requiring Manual Action","A critical remote code execution vulnerability in Windows Paint (CVE-2026-83844, CVSS 8.1) exposes systems to network-based attacks requiring no user interaction—a particularly dangerous threat profile. Microsoft chose to distribute the fix exclusively through the Microsoft Store rather than Windows Update, breaking the standard automated patching workflow that most organizations rely on. This means that even diligent IT teams with fully automated Windows Update policies are unknowingly leaving systems unpatched. The incident highlights a growing risk when vendors use fragmented update delivery channels, as security teams cannot assume a single patching pipeline covers all installed software.","**Immediate actions:**\n- Manually verify and update Microsoft Paint to build 11.2609.401.0 or later via the Microsoft Store across all user accounts and provisioned device copies.\n- Run an authenticated vulnerability scan across your entire estate to identify all systems still running vulnerable Paint builds below the patched version.\n\n**Long-term improvements:**\n- Expand software inventory and patch tracking to explicitly include Microsoft Store applications, not just traditionally managed Windows components.\n- Establish a process to monitor vendor security advisories for non-standard patch delivery channels and incorporate them into your patch management workflow.\n- Implement network-level controls (e.g., micro-segmentation or host-based firewalls) to restrict unnecessary inbound network access, reducing exposure to network-based RCE exploits.\n\n**Detection measures:**\n- Deploy endpoint detection rules that alert on anomalous process execution originating from Paint or similar low-privilege graphical applications.\n- Continuously audit installed application versions using an endpoint management platform (e.g., Intune, SCCM) to flag devices where Microsoft Store apps have not received recent updates.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 obligates essential and important entities to implement incident handling and vulnerability management practices that ensure all software—regardless of update delivery channel—is kept current to prevent exploitation.","Requirement 6 mandates that organizations protect systems against known vulnerabilities by installing applicable security patches in a timely manner, which here requires recognizing and acting on Store-delivered patches as valid security updates.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule, explicitly including tracking fixes from all vendor delivery mechanisms, not just standard update channels.","The vulnerability exists because a known-vulnerable component version remains in production; A06 directly addresses the risk of failing to track and update all software components, including OS utilities.","Regular authenticated scanning and a defined remediation SLA for critical vulnerabilities would have identified Paint's unpatched state even though the fix was not delivered via Windows Update.","This control mandates that organizations maintain awareness of technical vulnerabilities across all software assets and act promptly on remediation, covering non-traditional patch delivery paths like the Microsoft Store.","Because the exploit requires no user interaction and is network-based, enforcing strict network access controls to limit which hosts can reach vulnerable endpoints would reduce the attack surface while patching is completed.","published","2026-11-06T13:22:50.723089+00:00","2026-11-06T13:22:50.693+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fmicrosoft-paint-rce-fix-now-available.html","microsoft-paint-rce-fix-now-available-but-windows-update-won-t-deliver-it-0b7161","Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"4219f8e8-b0dd-4e63-97e9-d697daac68c4","2026-11-06","afternoon","ThreatNoir Afternoon Brief — November 6","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-06\u002Fthreatnoir-afternoon-brief-2026-11-06.mp3",[55,58,61],{"slug":38,"name":56,"problem":57},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":59,"problem":60},"Automated patch management","Known holes get closed in days, not months.",{"slug":62,"name":63,"problem":64},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]