CVE-2026-59124

Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 74th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile74th1.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your organization is running Microsoft HPC Pack 2019, and note the installed version.
Check whether you also have the related “windows app” component installed and note its version.
If Microsoft HPC Pack 2019 is installed, upgrade it to version 6.3.8359.
If the “windows app” component is installed, upgrade it to version 2.0.1314.0.
If you cannot patch right away, restrict network access to HPC Pack entry points (allow only required admin/compute traffic) and closely monitor for unusual inbound requests targeting HPC services.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-59124 is a remote “run arbitrary code” flaw in Microsoft HPC Pack 2019 that can let an attacker take over your system over the network; if you use HPC Pack 2019, you should act immediately and install the fixed update.

CVE-2026-59124 is a remote code execution vulnerability in Microsoft HPC Pack 2019 (CWE-502 deserialization of untrusted data), where an attacker can send crafted network data to trigger code execution without needing user interaction.

If you're affected

Full system takeover
Service outage risk
Data theft from compromised hosts
Wormable spread inside network

What is it

This vulnerability is like a “remote control” bug: if your system’s HPC services can be reached over the network, an attacker may be able to send specially crafted data that causes your system to run their code.

For a business, that can mean attackers gain full control of the affected computer, disrupt your computing workloads, and potentially access whatever data is available on that machine.

Who is affected

This matters if you run or manage Microsoft HPC Pack 2019, especially on servers that are reachable from other machines or the internet.

The risk exists only if the affected HPC Pack service is exposed in a way an attacker can reach it over the network and send crafted requests.

How urgent is it

RED: Attackers are reported to be exploiting this vulnerability (press attention cites exploitation tied to the Lazarus group). Because it enables remote code execution without any user interaction, a reachable exposed installation should be treated as actively at risk.

Do not wait for a scheduled maintenance window—prioritize the fixed update as soon as possible.

What to do — in detail

Inventory / confirm exposure
- Identify whether Microsoft HPC Pack 2019 is installed on any server.
- Record the exact Microsoft HPC Pack 2019 version.
- Identify whether the related “windows app” component is installed and record its exact version.
Determine whether you’re affected
- You are affected if you have Microsoft HPC Pack 2019 at a version earlier than the fixed version (fixed in 6.3.8359).
- You are affected if you have the related “windows app” component at a version earlier than the fixed version (fixed in 2.0.1314.0).
Patch / upgrade (preferred remediation)
- Upgrade Microsoft HPC Pack 2019 to 6.3.8359.
- Upgrade the “windows app” component to 2.0.1314.0.
Temporary workaround if patching is delayed
- Reduce exposure by limiting network paths that can reach HPC Pack services:
  - Allow only required admin/compute traffic.
  - Block unnecessary inbound access from untrusted networks.
- Ensure firewall rules and any reverse proxies/load balancers restrict traffic to only legitimate sources.
Validate after changes
- Re-check the installed versions to confirm they match the fixed versions.
- Review recent inbound logs on HPC-facing hosts for unusual traffic patterns consistent with exploitation attempts.
What to monitor next
- Monitor for new alerts related to HPC Pack services, suspicious inbound requests, and unexpected process starts on the HPC hosts.
- Keep an eye on Microsoft’s update guidance page for any follow-up clarifications for CVE-2026-59124.

CISA KEV note

This CVE is not listed in the CISA KEV at the time of the provided findings.

Technical context

Severity is very high (reported as Critical in the provided scoring context) and the mechanism is consistent with CWE-502: deserialization of untrusted data. In practical terms, HPC Pack can accept network data that, when crafted by an attacker, can lead to remote code execution.

Findings context:

There is no public exploit code on record.
Predicted likelihood exists but should not be treated as reassuring given the provided press/exploitation context.
Press attention indicates exploitation in the wild, attributed to the Lazarus group.

Fix information from vendor remediation:

Microsoft HPC Pack 2019 is fixed in 6.3.8359.
The related “windows app” component is fixed in 2.0.1314.0.

What KEV means here:

KEV listing would indicate confirmed exploitation activity tracked by CISA. For this CVE, KEV is not listed in the provided findings, but exploitation is still described via press reporting.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS74th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.5% chance of exploitation activity in the next 30 days, which ranks it in the 74th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-14Patch availablerecord updated
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft HPC Pack 2019On-premOperating Systems / windows
- windows appDesktop AppOn-premOperating Systems / windows

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable