LiveActive security incident?Get immediate response
CVE Record

CVE-2021-43890: Windows AppX Installer Spoofing Vulnerability

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. December 27 2023 Update: In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.

HighCVSS 7.1Known exploitedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Attackers can disguise malicious Windows application packages and persuade users to open them through phishing. Successful attacks can install malware, including families associated with credential theft and broader compromise. The attack requires user interaction, but Microsoft reported real-world abuse and CISA lists the vulnerability as known exploited.

Executive priority

Treat as a high-priority endpoint remediation and threat-hunting issue because exploitation is confirmed. Prioritize internet-facing user populations, privileged workstations, and environments allowing unmanaged software installation. Escalate immediately if suspicious App Installer activity or associated malware is detected.

Technical view

CVE-2021-43890 is a high-severity Microsoft App Installer spoofing vulnerability rated CVSS 7.1. Exploitation uses specially crafted packages or the ms-appinstaller URI scheme and requires user interaction. Microsoft later disabled the ms-appinstaller protocol by default in updated App Installer releases following increased threat activity.

Likely exposure

Windows endpoints using App Installer are the relevant population, especially where users can open emailed or linked application packages. Administrative users may experience greater impact than restricted users. The supplied version data lists 1.0.0.0, but does not establish a complete affected-version range.

Exploitation context

Active exploitation is supported by Microsoft's report of attacks involving Emotet, Trickbot, and Bazaloader, plus CISA KEV inclusion. Microsoft also observed increased financially motivated phishing and social-engineering activity abusing the ms-appinstaller URI scheme during 2023.

Researcher notes

The bundle confirms exploitation and vendor mitigation direction but does not provide a complete affected-version matrix, fixed-version list, or detailed detection indicators. Validate exact applicability and update status against Microsoft's advisory. CISA KEV inclusion strengthens urgency but does not establish prevalence within any specific organization.

Mitigation direction

  • Update Microsoft App Installer using the vendor advisory's approved update links.
  • Confirm the ms-appinstaller protocol is disabled unless a documented business requirement exists.
  • Apply Microsoft's current mitigations and workarounds for this CVE.
  • Use least-privilege accounts to reduce potential impact.
  • Strengthen controls against phishing attachments and unsolicited application-installation links.

Validation and detection

  • Inventory Windows endpoints and installed App Installer versions.
  • Verify App Installer updates are deployed through endpoint-management reporting.
  • Confirm the ms-appinstaller protocol is disabled by default on managed systems.
  • Review telemetry for suspicious App Installer launches, packages, and URI activity.
  • Investigate related phishing and malware detections, including named malware families.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-43890 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
Yes
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
4Timeline events
2ADP providers
7Source links

CISA KEV status

Status
Known exploited
Source
CISA-ADP
Date added
KEV reference

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: activeAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.25.9microsoft

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2021-43890Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. Added to KEVCISA-ADP

    CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvcother:kev

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
MicrosoftApp Installer1.0.0.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.