CVE-2026-66053: Apache Thrift: Python TSSLSocket Hostname Matcher Import

CVE-2026-66053 is a vulnerability in Apache Thrift: Python TSSLSocket Hostname Matcher Import, rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.9 (Medium). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.29% probability of exploitation activity in the next 30 days, higher than 22% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).

Key facts

CVE ID: CVE-2026-66053
Severity: Medium CVSS 5.9
Microsoft severity: Moderate
Exploited in the wild: No
Publicly disclosed: No
Weakness: CWE-297
EPSS: 0.29% (percentile 22%)
CISA KEV: Not listed
Released: 6 August 2026
Last updated: 6 August 2026
Patch Tuesday: July 2026 Patch Tuesday
Product families: Open Source Software

CVSS score and vector

Microsoft scores CVE-2026-66053 at 5.9 (temporal 5.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Metric	Value
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	None
Availability impact	None

Affected products (1)

Open Source Software

Product	Security update	Type	Fixed build	Restart
azl3 thrift 0.15.0-6 on Azure Linux 3.0	CBL-Mariner Releases	Security Update	0.24.0-1	No

NIST NVD data

NVD status: Analyzed
NVD CVSS: 5.9 (MEDIUM)
NVD weakness: CWE-297
Published to NVD: 27 July 2026
NVD last modified: 27 July 2026

Affected configurations (CPE)

Product	Vulnerable versions
thrift	before 0.24.0

References

https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9 (Release Notes)
https://lists.apache.org/thread/w4k5dnv1x58knwlhpo9x0or5xh220y65 (Vendor Advisory)

Revision history

Version	Date	Description
1.0	6 August 2026	Information published.