EUVD-2026-22565Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an authorized attacker to elevate privileges locally.
AnalysisAI
Deserialization of untrusted data in Microsoft HPC Pack 2019 enables authenticated local attackers to escalate privileges to SYSTEM level. Affects all versions below 6.3.8355. Vendor-released patch available via Microsoft Security Response Center. CVSS 7.8 reflects high impact (complete system compromise) with low attack complexity requiring only low-level authenticated access. No public exploit identified at time of analysis, though CWE-502 deserialization flaws are well-understood and commonly weaponized once technical details emerge.
Technical ContextAI
Microsoft High Performance Compute Pack (HPC Pack 2019) is an enterprise workload orchestration and cluster management platform for compute-intensive scientific and engineering applications. The vulnerability stems from unsafe deserialization (CWE-502) where the application accepts and processes serialized objects from untrusted sources without proper validation. In .NET environments like HPC Pack, deserialization flaws typically involve ObjectStateFormatter, BinaryFormatter, or NetDataContractSerializer classes that can instantiate arbitrary types during object reconstruction. An attacker with existing low-privilege credentials can craft malicious serialized payloads that, when processed by the HPC Pack service running with elevated privileges, execute arbitrary code in the security context of that service. The CPE string cpe:2.3:a:microsoft:microsoft_hpc_pack_2019 confirms this is specific to the 2019 product line, with EUVD data indicating all versions prior to 6.3.8355 contain the flaw.
RemediationAI
Upgrade Microsoft HPC Pack 2019 to version 6.3.8355 or later to remediate this vulnerability. The vendor-released patch is available through Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32184, which provides installation packages and detailed upgrade instructions. Organizations should prioritize patching production HPC head nodes and management servers first, then proceed with compute node updates during scheduled maintenance windows. Until patching is complete, implement defense-in-depth controls including strict access control to HPC Pack management interfaces, network segmentation isolating HPC infrastructure from general user networks, and enhanced monitoring for anomalous process creation or privilege changes on cluster management servers. Review user account permissions and remove unnecessary low-privilege accounts from HPC Pack environments to minimize attack surface. No effective workaround exists for deserialization vulnerabilities beyond complete patching, as the flaw is architectural rather than configuration-based.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today