Has anyone investigated the Tenable finding for Windows Package Manager (WinGet) versions below 1.30.80, associated with CVE-2026-68821? We tried installing the newer package, but the installer also adds SDKs and other files that seem unnecessary on a clean Windows Server deployment. Is there a supported way to update only the affected component, or should we wait for more clarification in Microsoft's security guidance?
2 Answers
If WinGet isn't needed on a server, removing it is a reasonable way to reduce the attack surface. However, check what is actually installed first and confirm that it stays removed, since App Installer or Store servicing may reinstall related components.
For servers where WinGet is not required, document its absence and validate the result with an inventory scan. If it is required, wait for a package that clearly includes the fixed version instead of deploying an installer that brings along unnecessary SDKs and supporting files.
WinGet normally isn't included natively on Windows Server, so there may be nothing to remove unless App Installer or another package was added separately.