Windows Paint RCE patched via Microsoft Store, not Windows Update

Affected Systems

Microsoft Paint on Windows systems. Vulnerable versions: below 11.2609.401.0. Fixed version: 11.2609.401.0 or later. Patch delivered exclusively through Microsoft Store, not Windows Update. Affects all user accounts and provisioned copies on each PC.

Exploitation Status

No active exploitation reported. Not publicly disclosed prior to October 13, 2026 patch release. Not listed in CISA KEV catalog. Exploitation requires no user interaction or authentication, but demands deep understanding of target system.

Business Impact

Remote code execution vulnerability (CVSS 8.1, Important severity) in Windows Paint allows unauthenticated network-based attacks via specially crafted packets. Non-standard patch delivery through Microsoft Store creates visibility gaps: traditional Windows Update mechanisms will not deploy this fix, and vulnerability scanners may report false negatives due to conflicting version information in CVE records (11.2605.91.0 vs. 11.2609.401.0). Per-user installation model means multiple vulnerable copies may exist on single systems.

Urgency

🟡 Within a week

Recommended Actions

• Run PowerShell commands as administrator to inventory all Paint installations: 'Get-AppxPackage -AllUsers -Name Microsoft.Paint | Select-Object Version' and 'Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq Microsoft.Paint | Select-Object Version'
• Update Paint to version 11.2609.401.0 or later via Microsoft Store for each user account, or enable Store auto-update to deploy the fix automatically
• For enterprise environments, use Intune or device management tools to trigger Store app update scans across all managed PCs
• Re-run inventory commands after patching to verify all user and provisioned copies show version 11.2609.401.0 or later
• Consider removing Paint via PowerShell on systems where it is not required to reduce attack surface until patching is complete