What is the CVSS score of EUVD-2026-25311?

EUVD-2026-25311 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Bing are affected by EUVD-2026-25311?

Microsoft Bing contains a critical remote code execution vulnerability (CVE-2026-33819, CVSS 10.0) allowing unauthenticated attackers to execute arbitrary code through unsafe deserialization.. A patch is available.

How to fix or mitigate EUVD-2026-25311?

Within 24 hours: inventory all Bing integrations, APIs, and services in use across enterprise applications and classify by business criticality; contact Microsoft for patch delivery status and timeline. Within 7 days: obtain and deploy the vendor-released patch to staging environments, validate application functionality and search integrity post-patch, and coordinate production rollout schedule with affected teams. Within 30 days: deploy the Microsoft Bing patch to all production instances and dependent systems, verify successful installation across infrastructure, and monitor security logs for exploitation indicators during the 30-day window.

Microsoft Bing EUVD-2026-25311

| CVE-2026-33819 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-04-23 microsoft

GHSA-97j9-4xhc-69qj

Deserialization Microsoft Microsoft Bing

10.0

CVSS 3.1 · NVD

Temporal: 8.7

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CIRCL (temporal)

8.7 HIGH

cvss

vuln.today AI

10.0 CRITICAL

Unauthenticated network deserialization RCE with no user interaction gives AV:N/AC:L/PR:N/UI:N; total technical impact and cloud-service back-end justify S:C and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 03:36 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 22:15 euvd

EUVD-2026-25311

Patch released

Apr 23, 2026 - 22:15 nvd

Patch available

CVE Published

Apr 23, 2026 - 21:35 nvd

CRITICAL 10.0

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Bing lets an unauthenticated network attacker run arbitrary code by submitting untrusted serialized data that the service deserializes unsafely (CWE-502). The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning exploitation of the Bing service could impact resources beyond its own security authority. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is a modest 0.27% (51st percentile), reflecting probability rather than confirmed activity.

Technical ContextAI

The root cause is CWE-502, deserialization of untrusted data: the application reconstructs objects from an attacker-controlled byte stream without validating the type or contents, allowing crafted payloads to instantiate dangerous types or trigger gadget chains that culminate in code execution. The single affected CPE is cpe:2.3:a:microsoft:microsoft_bing:*:*:*:*:*:*:*:*, i.e. the Microsoft Bing web/search service itself rather than an on-premises product. Because Bing is a Microsoft-operated cloud application, the vulnerable deserialization logic runs on Microsoft's own back-end infrastructure, which is consistent with the CVSS scope change (S:C) indicating that a compromise could cross into other Microsoft-managed components.

RemediationAI

Because Bing is a Microsoft-operated cloud service, remediation is delivered server-side by Microsoft rather than by customers: Patch available per vendor advisory - no exact fix version is provided, which is normal for a hosted service that Microsoft updates centrally, so verify the current status via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33819. No customer-side upgrade action is possible or required for the Bing service itself. Organizations that integrate Bing (for example via the Bing Search API or embedded Bing components) should confirm with Microsoft that their integration path is covered and monitor the MSRC entry for any client-side SDK guidance; if any locally deployed component consumes Bing-derived serialized data, restrict and validate that input and avoid deserializing untrusted payloads until Microsoft confirms full remediation.