EUVD-2026-56307
GHSA-cxrf-6fm5-464m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Deserialization RCE reachable over the network with no authentication or user interaction and low complexity, yielding full code execution, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft High Performance Computing (HPC) Pack allows an unauthorized network attacker to run arbitrary code by submitting maliciously crafted serialized data that the product deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 and requires no authentication or user interaction per the vector. A vendor patch is available; no public exploit has been identified at time of analysis.
Technical ContextAI
The root cause is CWE-502, deserialization of untrusted data: HPC Pack reconstructs objects from an attacker-controlled serialized byte stream without validating type or content, allowing a crafted payload to instantiate dangerous object graphs (gadget chains) that execute code during or after deserialization. HPC Pack is Microsoft's cluster-management stack for scheduling and running compute jobs across Windows Server nodes, so its head/broker services expose network-facing endpoints that accept serialized messages. In .NET, unsafe use of BinaryFormatter or similarly permissive deserializers is the classic driver of this bug class. Note the CPE/version data is inconsistent (see affected_products), so the exact affected component cannot be pinned from the provided sources.
RemediationAI
Apply the Microsoft-released security update for CVE-2026-59124 as the primary fix; the patch is available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59124, where the exact fixed build for your HPC Pack version should be confirmed (no precise fix version was included in the input data). Until the update is deployed, reduce exposure by restricting network access to HPC Pack head-node, broker, and scheduler service ports to trusted management subnets via host and perimeter firewall rules, which limits reachability of the vulnerable deserialization endpoint at the cost of constraining remote job submission and cross-network cluster management. Where feasible, place cluster control-plane services behind a VPN or isolated management VLAN and monitor for anomalous serialized traffic to those services; these controls narrow the attack surface but do not remove the underlying flaw, so patching remains mandatory.
More in Windows App
View allPrivilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low
Heap-based buffer overflow in Microsoft Remote Desktop Client enables remote code execution when a user connects to a ma
Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled or
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Remote Desktop Client Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is remotel
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network. Rated
An elevation of privilege vulnerability exists in Remote Desktop App for Mac in the way it allows an attacker to load un
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows remote unauthenticated attackers to rea
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows unauthenticated remote attackers to rea
Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled RD
Remote code execution in Microsoft Remote Desktop Client arises from a heap-based buffer overflow (CWE-122) that an unau
Remote code execution in Microsoft Remote Desktop Client is possible when a user is enticed to connect to an attacker-co
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today