EUVD-2026-56310
GHSA-8h97-p2pm-gjpw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-exposed service requires low-privilege authentication; CWE-250 privilege escalation yields full system impact with no complexity or interaction needed.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low-privilege access to elevate privileges to a higher level, potentially achieving full system compromise. The flaw stems from CWE-250 (Execution with Unnecessary Privileges), meaning a component within HPC Pack runs with more rights than its function requires, providing a lever for a legitimately authenticated user to abuse. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and full C/I/A impact triad indicate a serious risk in any environment where untrusted low-privilege users have network access to HPC Pack services.
Technical ContextAI
Microsoft High Performance Computing Pack is a job scheduling and cluster management platform built for Windows Server environments, typically deployed in research, scientific computing, and financial modeling contexts. CWE-250 (Execution with Unnecessary Privileges) is the root cause class: a software component operates under an overprivileged security context - for example, a service running as SYSTEM or a high-integrity process - that an authenticated lower-privileged caller can manipulate to perform actions beyond their assigned rights. The CVSS vector AV:N/AC:L/PR:L confirms the attack surface is a network-exposed service that accepts authenticated connections from low-privilege accounts. Notably, the EUVD affected version data references 'Windows App Client for Windows Desktop 1.00 <2.0.1193.0', which is inconsistent with the CVE description naming HPC Pack - this discrepancy should be verified against the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59133.
RemediationAI
A vendor-released patch is available from Microsoft. Based on EUVD data, the fix version for the Windows App Client for Windows Desktop component is 2.0.1193.0 or later. Administrators should consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59133 to obtain the specific update package for HPC Pack and apply it via Windows Update or the Microsoft Update Catalog. If immediate patching is not feasible, compensating controls should focus on reducing the low-privilege network attack surface: restrict network access to HPC Pack management and scheduler endpoints using host-based or perimeter firewall rules to limit exposure to only trusted administrative IP ranges; implement multi-factor authentication for all cluster user accounts to raise the effective cost of credential abuse; and audit all low-privilege user accounts on the cluster, removing stale or unnecessary accounts to reduce the pool of potential attackers. Note that firewall restrictions may impact legitimate cluster job submission workflows if applied broadly - scope rules to management interfaces rather than compute job APIs if workload continuity is required.
More in Windows App
View allRemote code execution in Microsoft High Performance Computing (HPC) Pack allows an unauthorized network attacker to run
Heap-based buffer overflow in Microsoft Remote Desktop Client enables remote code execution when a user connects to a ma
Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled or
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Remote Desktop Client Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is remotel
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network. Rated
An elevation of privilege vulnerability exists in Remote Desktop App for Mac in the way it allows an attacker to load un
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows remote unauthenticated attackers to rea
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows unauthenticated remote attackers to rea
Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled RD
Remote code execution in Microsoft Remote Desktop Client arises from a heap-based buffer overflow (CWE-122) that an unau
Remote code execution in Microsoft Remote Desktop Client is possible when a user is enticed to connect to an attacker-co
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today