What is the CVSS score of CVE-2026-54120?

CVE-2026-54120 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Surface Management Services are affected by CVE-2026-54120?

Microsoft Surface Management Services is vulnerable to remote code execution that could allow authenticated low-privilege users to execute arbitrary code on managed enterprise devices, affecting…. A patch is available.

How to fix or mitigate CVE-2026-54120?

Within 24 hours, conduct a complete asset inventory of all Microsoft Surface Management Services installations across the organization using the CPE identifier cpe:2.3:a:microsoft:surface_management_services:*:*:*:*:*:*:*:* to quantify exposure scope. Within 7 days, apply the vendor-released patch to all identified instances, beginning with internet-facing or externally-accessible management systems, and establish change tracking to verify successful deployment. Within 30 days, complete remediation verification across the entire managed device fleet, implement principle of least privilege access controls to Surface Management Services, and review network segmentation to isolate management traffic from general-purpose networks.

Surface Management Services CVE-2026-54120

EUVD-2026-48453 HIGH

Improper Input Validation (CWE-20)

2026-07-23 microsoft

GHSA-p4xg-f7pp-3rcc

Information Disclosure Microsoft Surface Management Services

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

CRITICAL

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

PR:L reflects the 'authorized attacker' prerequisite; S:U retained as service compromise is self-contained with no evidence of cross-system scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 00:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 00:52 vuln.today

cvss_changed

Severity Changed

Aug 06, 2026 - 00:52 NVD

CRITICAL HIGH

CVSS changed

Aug 06, 2026 - 00:52 NVD

9.9 (CRITICAL) 8.8 (HIGH)

Analysis Generated

Jul 24, 2026 - 00:46 vuln.today

CVE Published

Jul 23, 2026 - 23:55 cve.org

CRITICAL 9.9

DescriptionNVD

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Surface Management Services exposes networks to exploitation by authenticated low-privilege users who can send malformed input over the network to trigger arbitrary code execution. Affecting all tracked versions per CPE cpe:2.3:a:microsoft:surface_management_services:*:*:*:*:*:*:*:*, the vulnerability carries a CVSS 8.8 High rating with full confidentiality, integrity, and availability impact. No public exploits identified at time of analysis and EPSS at 0.71% suggests low current exploitation probability; the vulnerability is absent from the CISA KEV catalog.

Technical ContextAI

Microsoft Surface Management Services is an enterprise IT management platform for Microsoft Surface device fleets. The root cause is CWE-20 (Improper Input Validation), a class of defect where the application fails to sufficiently validate, sanitize, or constrain input data before processing it, allowing an attacker to supply unexpected values that redirect program execution. The affected CPE cpe:2.3:a:microsoft:surface_management_services:*:*:*:*:*:*:*:* uses a wildcard version specifier, indicating the flaw spans the full tracked version history of the application component. The CVSS AV:N metric confirms the vulnerable input surface is reachable over the network, distinguishing this from a local-only configuration flaw.

RemediationAI

Apply the vendor-released patch documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54120; the exact patched version number is not specified in available intelligence and must be confirmed directly from that advisory. As a compensating control pending patch deployment, restrict network access to the Surface Management Services endpoint to dedicated, trusted management VLANs or subnets using firewall ACLs, reducing the exploitable attack surface to a controlled network segment - note this does not eliminate the vulnerability but removes it from general network reach. Additionally, audit and minimize accounts with any level of access to the service, as the PR:L attack vector means any valid low-privilege credential is sufficient for exploitation; reducing the authorized user pool directly reduces exposure. Monitor MSRC and NVD for clarification on the 'Information Disclosure' versus 'code execution' impact discrepancy before finalizing compensating control scope.