What is the CVSS score of EUVD-2026-43994?

EUVD-2026-43994 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Age Of Empires Ii are affected by EUVD-2026-43994?

Microsoft Age of Empires II: Definitive Edition contains a remote code execution vulnerability (CVSS 8.8) that compromises user machines when victims load malicious game content such as downloaded…. A patch is available.

How to fix or mitigate EUVD-2026-43994?

Within 24 hours: inventory all systems running Age of Empires II and notify users of the vulnerability and available patch. Within 7 days: deploy Microsoft's released patch to all identified systems and verify successful installation across all affected endpoints. Within 30 days: conduct full patch compliance audit, confirm 100% coverage, and review installed mods and custom content for indicators of malicious loading attempts.

Age Of Empires Ii EUVD-2026-43994

| CVE-2026-50663 HIGH

Relative Path Traversal (CWE-23)

2026-07-14 microsoft

GHSA-339x-6c8m-xvxc

Path Traversal Microsoft Age Of Empires Ii

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:16 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 8.8

DescriptionCVE.org

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft's Age of Empires II: Definitive Edition Game is possible via a relative path traversal flaw (CWE-23) that lets a network-based attacker execute arbitrary code once a victim loads attacker-supplied content. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and requires user interaction, meaning a player must open or load a malicious game asset such as a downloaded map, mod, recording, or scenario. Microsoft has released a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.