CVE-2026-59124: Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability
CVE-2026-59124 is a remote code execution vulnerability in Microsoft High Performance Computing (HPC) Pack, rated Important by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 1.53% probability of exploitation activity in the next 30 days, higher than 75% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-59124
- Severity
- Critical CVSS 9.8
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- More Likely
- Weakness
- CWE-502
- EPSS
- 1.53% (percentile 75%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2026 Patch Tuesday
- Product families
- Azure
From the August 2026 Patch Tuesday briefing
Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability
This Critical RCE in Microsoft HPC Pack is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and is classified as CWE-502 (Deserialization of Untrusted Data). The practical prerequisite is network reachability to an HPC Pack component that accepts attacker-controlled serialized input. Where HPC clusters exist (research, engineering, financial compute), exposed management or job submission interfaces can become a direct path to remote code execution.
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-59124 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by submitting a specially crafted payload to an affected service that deserializes untrusted data. Successful exploitation could allow the attacker to execute code on the target system.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft HPC Pack 2019 | Release Notes | Security Update | 6.3.8359 | Maybe |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 9.8 (CRITICAL)
- NVD weakness
- CWE-502
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| windows app | before 2.0.1314.0 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59124 (Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | Corrected the listed software in the Security Updates table. Microsoft recommends installing the security update as soon as possible. | |
| 2.1 | Updated an acknowledgement. This is an informational change only. |