Vulnerabilities ›

CVE-2021-43890

Critical 🇺🇸 CISA KEV ⚡ Exploit Available

Microsoft Windows AppX Installer Spoofing Vulnerability — Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.

                    Published: Dec 15, 2021                                          ·  Source: CISA_KEV                

CVSS v3

9.0

🔗 NVD Official

📄 Description (English)

🤖 AI Executive Summary

CVE-2021-43890 is a critical spoofing vulnerability in Microsoft Windows AppX Installer (CVSS 9.0) that allows attackers to spoof legitimate applications and potentially execute malicious code with elevated privileges. The vulnerability affects multiple Windows versions and has publicly available exploits, making it an immediate threat to Saudi organizations. Patching is essential as this vulnerability can lead to complete system compromise and unauthorized access to sensitive data.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Apr 21, 2026 11:19

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability poses severe risks to Saudi banking sector (SAMA-regulated institutions), government agencies (NCA oversight), healthcare providers, and energy sector organizations. The spoofing capability enables attackers to distribute malicious applications disguised as legitimate software, potentially compromising financial systems, critical infrastructure, and sensitive government data. Telecom operators (STC, Mobily) and financial institutions are particularly vulnerable due to widespread Windows deployment in enterprise environments.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Healthcare and Medical Services Energy and Utilities Telecommunications Education Retail and E-commerce

🎯 MITRE ATT&CK Techniques

T1036 - Masquerading T1036.005 - Match Legitimate Name or Location T1204.001 - User Execution: Malicious Link T1204.002 - User Execution: Malicious File T1566.002 - Phishing: Spearphishing Attachment T1105 - Ingress Tool Transfer T1059.001 - Command and Scripting Interpreter: PowerShell

⚖️ Saudi Risk Score (AI)

9.2

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Inventory all Windows systems running AppX Installer across your organization

2. Disable AppX Installer if not required for business operations

3. Implement application whitelisting policies to restrict AppX installations

4. Monitor for suspicious AppX installation attempts in event logs (Event ID 11707, 11708)



PATCHING GUIDANCE:

1. Apply Microsoft security updates immediately (KB5007215 or later depending on Windows version)

2. Prioritize patching for systems in DMZ, user-facing endpoints, and critical infrastructure

3. Test patches in non-production environment before enterprise deployment

4. Verify patch installation using: Get-AppxPackage -AllUsers



COMPENSATING CONTROLS:

1. Restrict AppX package installation to administrators only via Group Policy

2. Implement code signing verification for all applications

3. Deploy endpoint detection and response (EDR) solutions

4. Enable Windows Defender SmartScreen for application reputation checking



DETECTION RULES:

1. Monitor Windows Event Log for AppX installation events from non-standard sources

2. Alert on unsigned or invalid certificate AppX packages

3. Track modifications to AppX package manifests

4. Monitor registry changes in HKLM\Software\Microsoft\Windows\CurrentVersion\AppModel

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. حصر جميع أنظمة Windows التي تشغل AppX Installer في المنظمة

2. تعطيل AppX Installer إذا لم تكن مطلوبة للعمليات التجارية

3. تطبيق سياسات القائمة البيضاء للتطبيقات لتقييد تثبيتات AppX

4. مراقبة محاولات تثبيت AppX المريبة في سجلات الأحداث

إرشادات التصحيح:

1. تطبيق تحديثات أمان Microsoft فوراً (KB5007215 أو أحدث)

2. إعطاء الأولوية لتصحيح الأنظمة في DMZ والأنظمة الحرجة

3. اختبار التصحيحات في بيئة غير الإنتاج قبل النشر

4. التحقق من تثبيت التصحيح باستخدام أوامر PowerShell

الضوابط البديلة:

1. تقييد تثبيت حزم AppX للمسؤولين فقط عبر Group Policy

2. تطبيق التحقق من التوقيع الرقمي لجميع التطبيقات

3. نشر حلول الكشف والاستجابة على نقاط النهاية

4. تفعيل Windows Defender SmartScreen

قواعد الكشف:

1. مراقبة سجل أحداث Windows لأحداث تثبيت AppX من مصادر غير قياسية

2. تنبيهات على حزم AppX غير الموقعة أو ذات الشهادات غير الصحيحة

3. تتبع التعديلات على بيانات AppX

4. مراقبة تغييرات السجل في مسارات AppModel

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 A.5.1.1 - Information Security Policies ECC 2024 A.6.1.1 - Organization of Information Security ECC 2024 A.12.2.1 - Change Management ECC 2024 A.12.6.1 - Management of Technical Vulnerabilities

🔵 SAMA CSF

SAMA CSF ID.BE-1 - Business Environment SAMA CSF PR.IP-1 - Information Protection Processes SAMA CSF PR.MA-2 - Address Identified Vulnerabilities SAMA CSF DE.CM-8 - Vulnerability Scans

🟡 ISO 27001:2022

ISO 27001:2022 A.12.3.1 - Segregation of Development, Test and Production Environments ISO 27001:2022 A.14.2.1 - Secure Development Policy ISO 27001:2022 A.12.6.1 - Management of Technical Vulnerabilities ISO 27001:2022 A.12.2.1 - Change Management

🟣 PCI DSS v4.0

PCI DSS 6.2 - Ensure Security Patches are Installed PCI DSS 6.3.1 - Identify and Evaluate Vulnerabilities PCI DSS 11.2.2 - Perform Quarterly Vulnerability Scans

🔗 References & Sources 0

No references.

📦 Affected Products / CPE 1 entries

Microsoft:Windows

📊 CVSS Score

9.0

/ 10.0 — Critical

📋 Quick Facts

Severity Critical

CVSS Score9.0

EPSS20.11%

Exploit ✓ Yes

Patch ✓ Yes

CISA KEV🇺🇸 Yes

KEV Due Date2021-12-29

Published 2021-12-15

Source Feed cisa_kev

🇸🇦 Saudi Risk Score

9.2

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

kev actively-exploited ransomware

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2021-43890

Introduce Yourself

Sign In Required