[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmu0r5mBRO5lDH-32VZSsJiWi2XYk5P0N47Tj0Fx0fVE":3},{"article":4,"iocs":39,"watch_terms":44,"solutions":45,"lesson":111},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"005ad9c3-ab88-4f7f-b335-f1666d53f5e9","Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It","microsoft-paint-rce-fix-now-available-but-windows-update-won-t-deliver-it-0b7161","A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates","Microsoft has released a fix for CVE-2026-83844, a critical remote code execution vulnerability in Windows Paint (CVSS 8.1), but only through the Microsoft Store—not via traditional Windows Update. The flaw, an out-of-bounds read affecting Paint builds below 11.2609.401.0, allows network-based code execution without user interaction. Administrators must manually verify and deploy the Store update across all user accounts and provisioned copies to ensure complete remediation.","Microsoft releases Paint RCE fix via Store only; Windows Update won't deliver CVE-2026-83844 patch.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fmicrosoft-paint-rce-fix-now-available.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgFEFFUv1MUNRoFx03Jcw0k5NZCU0EOf5qEpbvAEQoTSTzoxHWPk1rc7XgQeG1USPP9vVB0ePI_lzQLqBU5bHdQ7-YrwEXFo8gJwayqwCvCtcDrw1JYMxKYxieV3bcQeCRAJAxt8CRfifzMzL22_ab0Z0OxwWrNckC36gPEOnubZnzagv6DkV7iY4AQJfA\u002Fs1600\u002Fpaint-rce.jpg","2026-11-06T12:06:43+00:00","2026-11-06T13:00:37.829456+00:00",9,[17,20,23,25],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Windows Paint","product",{"name":24,"type":22},"Microsoft Store",{"name":26,"type":27},"Windows Update","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",[40],{"type":41,"value":42,"context":43},"cve","CVE-2026-83844","Remote code execution vulnerability in Windows Paint; out-of-bounds read flaw",[18,21,24],{"controls":46,"vendors":107},[47,76,100],{"slug":48,"name":49,"problem":50,"products":51},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":77,"name":78,"problem":79,"products":80},"patch-management","Automated patch management","Known holes get closed in days, not months.",[81,89,93],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":77,"product_name":90,"url":91,"description":92},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":94,"vendor_name":18,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[105,106],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},{"vendor_slug":94,"vendor_name":18,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},[108],{"slug":94,"name":18,"logo_path":95,"roles":109},[110],"affected",{"slug":112,"title":113,"body":114,"framework_refs":115,"framework_notes":123},"microsoft-paint-rce-patch-bypasses-windows-update-requiring-manual-action","Microsoft Paint RCE Patch Bypasses Windows Update, Requiring Manual Action","A critical remote code execution vulnerability in Windows Paint (CVE-2026-83844, CVSS 8.1) exposes systems to network-based attacks requiring no user interaction—a particularly dangerous threat profile. Microsoft chose to distribute the fix exclusively through the Microsoft Store rather than Windows Update, breaking the standard automated patching workflow that most organizations rely on. This means that even diligent IT teams with fully automated Windows Update policies are unknowingly leaving systems unpatched. The incident highlights a growing risk when vendors use fragmented update delivery channels, as security teams cannot assume a single patching pipeline covers all installed software.",[116,117,118,119,120,121,122],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":124,"PCI DSS Requirement 6":125,"NIST SP 800-53 SI-2: Flaw Remediation":126,"OWASP A06:2021 Vulnerable and Outdated Components":127,"CIS Control 7: Continuous Vulnerability Management":128,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":129,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":130},"NIS2 obligates essential and important entities to implement incident handling and vulnerability management practices that ensure all software—regardless of update delivery channel—is kept current to prevent exploitation.","Requirement 6 mandates that organizations protect systems against known vulnerabilities by installing applicable security patches in a timely manner, which here requires recognizing and acting on Store-delivered patches as valid security updates.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule, explicitly including tracking fixes from all vendor delivery mechanisms, not just standard update channels.","The vulnerability exists because a known-vulnerable component version remains in production; A06 directly addresses the risk of failing to track and update all software components, including OS utilities.","Regular authenticated scanning and a defined remediation SLA for critical vulnerabilities would have identified Paint's unpatched state even though the fix was not delivered via Windows Update.","This control mandates that organizations maintain awareness of technical vulnerabilities across all software assets and act promptly on remediation, covering non-traditional patch delivery paths like the Microsoft Store.","Because the exploit requires no user interaction and is network-based, enforcing strict network access controls to limit which hosts can reach vulnerable endpoints would reduce the attack surface while patching is completed."]