Vulnerability in OpenSSL (CVE-2026-28387) Path(s) : C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2608.49021.0_x64__8wekyb3d8bbwe\libssl-3-x64.dll

The reported file belongs to the Microsoft 365 Copilot app, formerly named the Microsoft 365 (Office) app. It is delivered as the signed Microsoft.MicrosoftOfficeHub Microsoft Store package. (apps.microsoft.com)

CVE-2026-28387 affects specific OpenSSL versions, including:

• OpenSSL 3.5.0 through 3.5.5
• OpenSSL 3.4.0 through 3.4.4
• OpenSSL 3.3.0 through 3.3.6
• OpenSSL 3.0.0 through 3.0.19

The corresponding corrected versions are 3.5.6, 3.4.5, 3.3.7, and 3.0.20. The vulnerability applies to an uncommon DANE TLSA-based server-authentication configuration, so detecting the DLL version alone does not confirm that the application exposes the vulnerable code path. (openssl-library.org)

Please use the following remediation steps:

1. Open Microsoft Store > Library > Get updates and install the latest update for Microsoft 365 Copilot.
2. If Store updates are centrally managed, deploy the latest Microsoft Store package through your organization’s application-management solution.
3. Restart the device and run the vulnerability scan again.
4. Check the installed package version with PowerShell:

Get-AppxPackage -AllUsers Microsoft.MicrosoftOfficeHub |

    Select-Object Name, Version, PackageFullName, InstallLocation

5. Check the DLL’s actual file version rather than relying only on the package version:

Get-Item "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2608.49021.0_x64__8wekyb3d8bbwe\libssl-3-x64.dll" |

    Select-Object -ExpandProperty VersionInfo |

    Select-Object FileVersion, ProductVersion

Do not manually delete or replace libssl-3-x64.dll. Files under C:\Program Files\WindowsApps are part of a signed and access-controlled application package. Manually modifying them can corrupt the package and prevent future servicing.

If the Microsoft 365 Copilot app is not required, it can instead be uninstalled through Settings > Apps > Installed apps. For enterprise devices, remove it using your approved application-management process rather than changing the WindowsApps directory manually.

If the latest Store package still contains an OpenSSL version below the corrected version, please provide:

• The output of both PowerShell commands
• The vulnerability scanner name and plugin or detection ID
• Whether Microsoft Store updates are enabled or blocked
• The Windows edition and build
• Whether an older package directory remains after the update

An old package folder may remain temporarily because another user profile still has that package registered. Please remove usernames, tenant details, device names, and other sensitive information before sharing the output.