Relevant area(s)
WinGet CLI
Relevant command(s)
winget upgrade
Brief description of your issue
MSRC identifies build 1.30.80 as the fixed version for CVE-2026-68821. However, after installing the package downloaded from the MSRC page, WinGet reports v1.29.280 instead of v1.30.80. This creates a discrepancy with vulnerability scanners that identify versions below 1.30.80 as vulnerable.
Steps to reproduce
Start with a machine running an older WinGet version, for example v1.28.220.
Download the WinGet/App Installer package identified by MSRC as build 1.30.80 for CVE-2026-68821.
Install the downloaded package.
Run:
winget --version
Check the installed App Installer package:
Get-AppxPackage -AllUsers Microsoft.DesktopAppInstaller | Select-Object Name, Version, PackageFullName
The installed version is reported as:- WinGet: v1.29.280
- Microsoft.DesktopAppInstaller: 1.29.280.0
The package therefore does not report version 1.30.80, despite the MSRC package being identified as build 1.30.80.
Expected behavior
After installing the package provided by MSRC and identified as build 1.30.80, WinGet should report the corresponding fixed version for CVE-2026-68821, expected to be v1.30.80 or later.
The installed Microsoft.DesktopAppInstaller package version should also correspond to the fixed release.
Actual behavior
After installing the MSRC-provided package identified as build 1.30.80, WinGet reports v1.29.280.
The installed package is also reported as:
Microsoft.DesktopAppInstaller 1.29.280.0
The previous WinGet version was v1.28.220, so the package does update WinGet, but the resulting version does not match the 1.30.80 build referenced by MSRC.
Environment
WinGet Package Manager version: v1.29.280
Windows: Windows.Desktop v10.0.26100.9168
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.29.280.0
Previous WinGet version: v1.28.220
MSRC package/build: 1.30.80
This creates a discrepancy for vulnerability remediation because Nessus reports WinGet versions below 1.30.80 as vulnerable, while the MSRC-provided package results in WinGet v1.29.280.
Relevant area(s)
WinGet CLI
Relevant command(s)
winget upgrade
Brief description of your issue
MSRC identifies build 1.30.80 as the fixed version for CVE-2026-68821. However, after installing the package downloaded from the MSRC page, WinGet reports v1.29.280 instead of v1.30.80. This creates a discrepancy with vulnerability scanners that identify versions below 1.30.80 as vulnerable.
Steps to reproduce
Start with a machine running an older WinGet version, for example v1.28.220.
Download the WinGet/App Installer package identified by MSRC as build 1.30.80 for CVE-2026-68821.
Install the downloaded package.
Run:
winget --version
Check the installed App Installer package:
Get-AppxPackage -AllUsers Microsoft.DesktopAppInstaller | Select-Object Name, Version, PackageFullName
The installed version is reported as:- WinGet: v1.29.280
The package therefore does not report version 1.30.80, despite the MSRC package being identified as build 1.30.80.
Expected behavior
After installing the package provided by MSRC and identified as build 1.30.80, WinGet should report the corresponding fixed version for CVE-2026-68821, expected to be v1.30.80 or later.
The installed Microsoft.DesktopAppInstaller package version should also correspond to the fixed release.
Actual behavior
After installing the MSRC-provided package identified as build 1.30.80, WinGet reports v1.29.280.
The installed package is also reported as:
Microsoft.DesktopAppInstaller 1.29.280.0
The previous WinGet version was v1.28.220, so the package does update WinGet, but the resulting version does not match the 1.30.80 build referenced by MSRC.
Environment