Windows AppX Installer Spoofing Vulnerability (CVE-2021-43890)

What is affected, what to do

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update app_installer to version 1.16. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft App Installer gte 1.0.0.0..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Update Desktop App Installer: Move every client on the App Installer 1.11 and 1.16 branches to the fixed build via Microsoft Store or Intune/Store for Business. A patch is available from the vendor; look up the exact version in the vendor advisory. Inventory the fleet with Get-AppxPackage -AllUsers Microsoft.DesktopAppInstaller | Select Name,Version.
   • Enforce-disable the ms-appinstaller protocol: The December 2023 update turns it off by default. Pin that state with the GPO "Windows Components > Desktop App Installer > Enable App Installer ms-appinstaller protocol" = Disabled (registry: HKLM\SOFTWARE\Policies\Microsoft\Windows\AppInstaller\EnableMSAppInstallerProtocol = 0). This stops stale installs from re-enabling it.
   • Mail gateway: Quarantine attachments and links ending in .appx, .appxbundle, .msix, .msixbundle and .appinstaller. Block ms-appinstaller:?source= URIs at mail and web proxy.
   • Retro-hunt: Search 30 to 90 days back for MSIX/AppX installs from unmanaged sources (see Detection rules). Isolate any hits and investigate for Emotet/TrickBot/BazaLoader follow-on activity.
   • On confirmed compromise: Reset the affected user's credentials and any cached or privileged credentials present on the host. These loaders are initial-access tooling for credential theft and ransomware.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration/GPO: Where there is no business need, disable App Installer entirely ("Enable App Installer" = Disabled). Restrict sideloading by turning off "Allow all trusted apps to install", so only Store or explicitly approved packages can be installed.
   • Application control: Use AppLocker Packaged app Rules or WDAC publisher rules to allow only approved signing certificates. Default-deny all other MSIX/AppX packages.
   • Least privilege: Run users as standard accounts. The advisory notes that non-admin users are less impacted. Use LAPS for local admin accounts.
   • Web proxy/IPS: Block downloads of .appinstaller/.msix files and the content types application/msix, application/appx and application/appinstaller from uncategorised or newly registered domains. Add an IPS pattern for ms-appinstaller: in HTTP responses and redirects.
   • User awareness: Send a targeted phishing notice about fake "Adobe/PDF component" or "browser update" pages that prompt users to install an app. This is the typical lure.
3. 03

   Runbook step 3

   Detection rules

   • Windows event logs: Forward Microsoft-Windows-AppXDeploymentServer/Operational and Microsoft-Windows-AppxPackagingOM/Operational to the SIEM. Alert on deployment events (e.g. EID 400/404) where the package source is an HTTP(S) URL or a user path (\Downloads\, \INetCache\).
   • EDR process ancestry: browser or mail client → AppInstaller.exe → binary under C:\Program Files\WindowsApps\<unknown publisher>\ → powershell.exe/cmd.exe/rundll32.exe. Sigma shape: ParentImage|contains: '\WindowsApps\' AND Image|endswith: ['\powershell.exe','\cmd.exe','\rundll32.exe'].
   • Defender for Endpoint (KQL): DeviceProcessEvents | where InitiatingProcessFileName =~ "AppInstaller.exe" or ProcessCommandLine has "ms-appinstaller:"
   • Proxy/Zeek: In http.log/proxy logs, look for URIs ending .appinstaller|.msix|.appx or Location headers containing ms-appinstaller:?source=. SPL: index=proxy (uri="*.msix" OR uri="*.appinstaller" OR uri="*ms-appinstaller*") | stats count by src_ip, dest_host
   • Signer review: Compare newly installed packages that have unknown or recently issued code-signing certificates (Get-AppxPackage | Select Publisher, SignatureKind) against your approved publisher list.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. December 27 2023 Update: In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.

Source: CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Microsoft App Installer

References & sources

• portal.msrc.microsoft.comen-US/security-guidance/advisory/CVE-2021-43890x_refsource_MISC
• bleepingcomputer.comnews/microsoft/microsoft-disables-msix-protocol-handler-abused-…
• thehackernews.com2023/12/microsoft-disables-msix-app-installer.html
• microsoft.comen-us/security/blog/2023/12/28/financially-motivated-threat-act…
• github.comChrisTitusTech/winutil/pull/26
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43890government-resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 06.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2021-43890","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T20:33:55.454012Z"}	{"id":"CVE-2021-43890","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2021-12-14T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 05.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2021-43890","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"slow"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2021-12-14T00:00:00+00:00"}	{"id":"CVE-2021-43890","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-05T20:33:55.454012Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0