Microsoft has confirmed CVE-2026-83844, a high-severity remote code execution vulnerability affecting Windows Paint on Windows 11 systems. The flaw carries a CVSS score of 8.1 and allows an unauthenticated attacker to execute code over a network without user interaction. What makes this vulnerability particularly dangerous for Kent SMEs is that
Paint gets this fix only through a Store update, not through Windows updates
, meaning businesses that rely on automatic Windows Update policies remain vulnerable even with fully patched systems.
The vulnerability was disclosed on 13 October 2026, but the proper fix—Paint build 11.2609.401.0—only became widely available through the Microsoft Store on 6 November 2026. For Kent businesses running Windows 11 workstations, this creates a critical security gap that demands immediate manual intervention.
What Is Microsoft Paint CVE-2026-83844 and Why It Matters for Kent SMEs
CVE-2026-83844 is a high-severity Microsoft Paint RCE
caused by an out-of-bounds read vulnerability.
Microsoft disclosed the vulnerability on October 13, and if left unpatched, it could allow an attacker to run code on your PC over a network without you clicking anything
.
The vulnerability is particularly concerning because:
- Its assessment indicates a network-based attack requiring no privileges or user interaction, although successful exploitation has high complexity
- A specially crafted image can potentially be used to trigger the flaw and execute malicious code on an affected system
- It affects the Microsoft Store version of Paint that ships with Windows 11
- Windows Update does not deliver the security patch automatically
While
as of November 6, 2026, Microsoft reports no known exploitation and no public disclosure
, the network-based attack vector means Kent SMEs cannot afford to wait. The vulnerability is rated “Important” by Microsoft rather than “Critical,” but the CVSS 8.1 score places it firmly in the high-severity category.
Why Windows Update Won’t Protect Your Kent Business From This Vulnerability
Most Kent SMEs rely on Windows Update to keep their systems secure, but this vulnerability exposes a critical gap in that assumption.
Because Paint is serviced through the Microsoft Store, a fully patched Windows operating system does not necessarily prove that the application itself has received the security update
.
This creates a dangerous situation where:
- Your Windows 11 systems show as fully updated in Windows Update
- Your vulnerability scanners may report systems as compliant
- Paint remains vulnerable to remote code execution attacks
- IT teams have no automatic notification that manual Store updates are required
The confusion has been compounded by Microsoft’s initial communication.
Brian Vitko of RFF, a device-management software maker, checked which Paint builds the Store offered in six countries earlier this week. He found that the newest in each was 11.2605.81.0, a build without the fix
. Only on 6 November did the patched version become widely available.
This mirrors the broader challenge Kent SMEs face with application security. Similar to issues we’ve covered regarding Windows 11 update problems breaking Remote Desktop and Windows 11 23H2 end of support deadlines, patching has become increasingly complex with multiple update channels requiring separate management attention.
How to Check If Your Kent Business Is Vulnerable Right Now
Kent SMEs must immediately verify which Paint build is installed across their Windows 11 estate. Here’s how to check:
Manual Check on Individual Workstations
- Open Microsoft Paint
- Click the Settings icon (gear symbol) in the top-right corner
- Select “About Paint”
- Check the version number displayed
Microsoft’s security advisory names 11.2609.401.0 as the fixed build. A copy at 11.2609.401.0 or later passes under both numbers
. Any version below 11.2609.401.0 remains vulnerable to CVE-2026-83844.
Enterprise-Scale Verification
For Kent businesses with more than a handful of workstations, manual checking is impractical. IT teams should:
- Query Microsoft Store app versions via PowerShell or device management platforms
- Check vulnerability scanner reports specifically for CVE-2026-83844
- Review enterprise antivirus console alerts—some enterprise security software is flagging vulnerable Paint installations
- Document which machines require manual Store updates
What Kent SMEs Must Do to Patch Microsoft Paint CVE-2026-83844 Immediately
Unlike normal Windows security updates, this vulnerability requires manual intervention through the Microsoft Store:
Individual Workstation Patching
- Open the Microsoft Store app on Windows 11
- Click “Library” in the bottom-left corner
- Click “Get updates” to refresh available updates
- Locate “Paint” in the list and click “Update”
- Wait for Paint 11.2609.401.0 to download and install
- Verify the new version number through Settings > About Paint
Enterprise Deployment Options
Kent businesses managing multiple Windows 11 devices have several options:
- Microsoft Store for Business policies: Configure automatic app updates where possible, though this requires Microsoft Store for Business infrastructure
- Microsoft Intune: Deploy Microsoft Store app updates through Intune policies to managed devices
- PowerShell scripts: Use scripted Store app update commands deployed via Group Policy or management platforms
- User communication: Send clear instructions to staff on how to manually update Paint, with deadline dates
Whichever method you choose, verification is critical. Do not assume the update has deployed successfully without checking the actual Paint version number on a sample of devices.
How This Vulnerability Fits Into the Broader UK SME Threat Landscape November 2026
CVE-2026-83844 emerges against a backdrop of escalating cyber threats facing UK SMEs. As we reported last week, UK businesses faced a record 203,585 cyberattack attempts each in Q3 2026, and the NCSC warns that AI-powered ransomware attacks are highly likely by 2028.
Network-based remote code execution vulnerabilities are particularly valuable to attackers because:
- They require no user interaction, allowing automated exploitation
- They can be exploited across entire networks once initial access is gained
- They provide execution capabilities that enable ransomware deployment, data theft and lateral movement
- Unpatched systems create persistent footholds for advanced persistent threat actors
The fact that this vulnerability affects a default Windows application that many businesses assume is automatically patched makes it an attractive target. Attackers frequently scan for vulnerabilities with low patch rates precisely because they know organisations struggle with non-standard update processes.
Preventing Similar Security Gaps: What Kent SMEs Must Change About Patch Management Now
The Microsoft Paint vulnerability exposes a fundamental weakness in how many Kent SMEs approach patch management: the assumption that Windows Update handles all security patches automatically.
To close this gap, Kent businesses must:
Expand Patch Management Scope Beyond Windows Update
- Include Microsoft Store apps in regular vulnerability scanning
- Monitor security advisories for applications distributed outside Windows Update
- Implement processes to verify Store app versions across the estate
- Test and deploy Store app updates through the same change management process as Windows patches
Improve Visibility and Verification
- Configure asset management tools to track Microsoft Store app versions
- Run regular compliance scans that check actual installed versions against known vulnerabilities
- Document which applications require manual update processes
- Create alerts when critical Store app updates are released
Educate Staff and IT Teams
- Train IT teams that not all Windows security updates deploy through Windows Update
- Communicate to staff when manual updates are required for security reasons
- Provide clear, step-by-step instructions for non-technical users
- Set expectations that some security updates require immediate user action
For many Kent SMEs, this requires rethinking patch management infrastructure. Organisations that have invested in Cyber Essentials certification will already have documented patch management processes, but those processes must now explicitly include Microsoft Store apps alongside traditional Windows updates.
Support for Kent SMEs Managing Complex Windows 11 Security Updates
The Microsoft Paint CVE-2026-83844 vulnerability is a wake-up call for Kent businesses that rely solely on automatic Windows Update policies. As Microsoft’s application distribution model evolves, patch management becomes increasingly complex, requiring expertise and processes that many SMEs lack internally.
If your Kent business needs support verifying Paint versions across your estate, deploying the security update or improving your patch management processes to prevent similar gaps, Meridian Micro can help. Our IT support team works with SMEs across Kent and the South East to implement comprehensive patch management that covers Windows updates, Microsoft Store apps and third-party applications.
Contact Meridian Micro today on 01303 883111 to discuss how we can verify your systems are protected against CVE-2026-83844 and establish robust patch management processes that close security gaps before attackers exploit them.