CVE-2021-43890
CVE-2021-43890 is a security flaw in Microsoft Windows, Microsoft’s operating system for PCs and servers. Attackers can make something fake look genuine in Microsoft Windows. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 15 Dec 2021, and says ransomware gangs have used it.[1]
Microsoft Windows is in things households have, such as phones, computers, browsers and everyday apps, so the fix matters at home as much as at work. Fixed in version publication of App Installer.
Description
CISA calls it an appX installer spoofing in Microsoft Windows. In its words: “Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.”[1]
The CVE record adds: “We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you…”[2]
It scores 7.1 out of 10 on the Common Vulnerability Scoring System, which rates it high, scored by NVD using CVSS 3.1.[2]
Affected versions
NVD’s record lists one fixed version: everything before it is affected.[2]
| Product | Fixed in |
|---|---|
| App Installer | publication |
Every device with Microsoft Windows needs the update.
Exploitation
CISA added it to its catalog of known exploited vulnerabilities on 15 Dec 2021, within a day of it being made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 29 Dec 2021 to fix it.[1] CISA says ransomware gangs have used it.
FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at 11%. That’s in the top 5% of the flaws it scores.[4]
CISA assesses it as not automatable: each attack takes some work.
CISA doesn’t say who was attacked, or how.
Fix
Microsoft has published a fix or advice.[3] CISA’s required action: “Apply updates per vendor instructions.”[1]
- Update Microsoft Windows now.On Windows: Settings, Windows Update, Check for updates, then restart. Office updates come the same way, or from any Office app: File, Account, Update Options. Then turn on automatic updates, so the next fix arrives on its own.
- Check you’re on publication or later.Fixed in version publication of App Installer. Anything older is what attackers are going after.
- If there’s no update, stop using it.CISA’s advice when a flaw being used in attacks has no fix is to stop using the product until it does.
Timeline
| Date | Event |
|---|---|
| The flaw is made public in the National Vulnerability Database, with a severity score of 7.1.[2] | |
| CISA adds it to its catalog of flaws known to be used in attacks, noting that ransomware gangs have used it.[1] | |
| CISA’s deadline for US government agencies to fix it.[1] | |
| FIRST puts the odds of it being used in attacks in the next 30 days at 11%.[4] |
See also
Other Microsoft Windows flaws
- CVE-2026-96951: command injection ·
- CVE-2026-85880: heap-based buffer overflow ·
- CVE-2026-81963: link following ·
- CVE-2008-4250: buffer overflow ·
- CVE-2026-32202: protection mechanism failure ·
- CVE-2025-60710: link following ·
Similar flaws
- CVE-2026-118527, Ivanti Connect Secure: generation of predictable numbers or identifiers ·
- CVE-2026-46300, Linux Kernel: missing initialization of a variable ·
- CVE-2026-41709, Broadcom VMware ESX: insufficient logging ·
- CVE-2026-96656, Plex Media Server: external control of file name or path ·
- CVE-2026-96654, Plex Media Server: improper neutralization of encoded URI schemes in a web page ·
Added the same day
- CVE-2021-4102, Chrome and other Chromium browsers: use-after-free ·
Every Microsoft flaw on CISA’s list · Everything added in December 2021
References
- ^ Cybersecurity and Infrastructure Security Agency. “Microsoft Windows AppX Installer Spoofing Vulnerability”. Known Exploited Vulnerabilities Catalog, added 15 Dec 2021.
- ^ National Institute of Standards and Technology. “CVE-2021-43890 Detail”. National Vulnerability Database, published 15 Dec 2021.
- ^ Microsoft. Advisories and fixes: portal.msrc.microsoft.com.
- ^ FIRST. “Exploit Prediction Scoring System”. EPSS 0.113, percentile 96.0, 31 Oct 2026.
- CVE Program. “CVE-2021-43890”. The official CVE record.
This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.