What is the CVSS score of CVE-2026-32184?

CVE-2026-32184 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft are affected by CVE-2026-32184?

Microsoft HPC Pack 2019 contains a privilege escalation vulnerability that allows authenticated local users to gain SYSTEM-level access, potentially compromising high-performance computing…. A patch is available.

How to fix or mitigate CVE-2026-32184?

Within 24 hours: Inventory all Microsoft HPC Pack 2019 installations and document current versions. Within 7 days: Apply vendor-released patch to version 6.3.8355 or later across all HPC Pack 2019 deployments, prioritizing systems handling sensitive research or production workloads. Within 30 days: Verify patch deployment completion and review access logs for unauthorized privilege escalation attempts on patched systems.

Microsoft CVE-2026-32184

EUVD-2026-22565 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-04-14 microsoft

Deserialization Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:21 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22565

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an authorized attacker to elevate privileges locally.

AnalysisAI

Deserialization of untrusted data in Microsoft HPC Pack 2019 enables authenticated local attackers to escalate privileges to SYSTEM level. Affects all versions below 6.3.8355. Vendor-released patch available via Microsoft Security Response Center. CVSS 7.8 reflects high impact (complete system compromise) with low attack complexity requiring only low-level authenticated access. No public exploit identified at time of analysis, though CWE-502 deserialization flaws are well-understood and commonly weaponized once technical details emerge.

Technical ContextAI

Microsoft High Performance Compute Pack (HPC Pack 2019) is an enterprise workload orchestration and cluster management platform for compute-intensive scientific and engineering applications. The vulnerability stems from unsafe deserialization (CWE-502) where the application accepts and processes serialized objects from untrusted sources without proper validation. In .NET environments like HPC Pack, deserialization flaws typically involve ObjectStateFormatter, BinaryFormatter, or NetDataContractSerializer classes that can instantiate arbitrary types during object reconstruction. An attacker with existing low-privilege credentials can craft malicious serialized payloads that, when processed by the HPC Pack service running with elevated privileges, execute arbitrary code in the security context of that service. The CPE string cpe:2.3:a:microsoft:microsoft_hpc_pack_2019 confirms this is specific to the 2019 product line, with EUVD data indicating all versions prior to 6.3.8355 contain the flaw.

RemediationAI

Upgrade Microsoft HPC Pack 2019 to version 6.3.8355 or later to remediate this vulnerability. The vendor-released patch is available through Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32184, which provides installation packages and detailed upgrade instructions. Organizations should prioritize patching production HPC head nodes and management servers first, then proceed with compute node updates during scheduled maintenance windows. Until patching is complete, implement defense-in-depth controls including strict access control to HPC Pack management interfaces, network segmentation isolating HPC infrastructure from general user networks, and enhanced monitoring for anomalous process creation or privilege changes on cluster management servers. Review user account permissions and remove unnecessary low-privilege accounts from HPC Pack environments to minimize attack surface. No effective workaround exists for deserialization vulnerabilities beyond complete patching, as the flaw is architectural rather than configuration-based.