CVE-2021-28326: 
vulnerability analysis and mitigation

The Windows AppX Deployment Server Denial of Service Vulnerability (CVE-2021-28326) was discovered and reported on January 5, 2021, with public disclosure occurring on April 21, 2021. This vulnerability affects various versions of Microsoft Windows, including Windows 10 and Windows Server 2016. The vulnerability was assigned a CVSS v3.1 base score of 6.1 (Medium severity) by NIST (NVD, ZDI Advisory).

The vulnerability exists within the AppX Deployment Service of Microsoft Windows. The specific flaw allows attackers to abuse the service through the creation of a directory junction, which can be exploited to delete the contents of a chosen directory. The vulnerability has been assigned different CVSS vectors by different organizations, with NIST rating it as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H (6.1 Medium) and Microsoft assessing it as CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (5.5 Medium) (NVD, ZDI Advisory).

When successfully exploited, this vulnerability can create a denial-of-service condition on the affected system. The attack can result in the deletion of directory contents, potentially causing system instability or service disruption (ZDI Advisory).

The vulnerability requires local access to exploit, meaning an attacker must first obtain the ability to execute low-privileged code on the target system. The attack complexity is considered low, but it does require certain privileges or user interaction depending on the assessment (ZDI Advisory).

Microsoft has released a security update to address this vulnerability. Users and administrators are advised to apply the available patches through the standard Windows Update mechanism (Microsoft Advisory).