Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network.
In plain language
Written by AI from the record
CVE-2026-59133 is an elevation-of-privilege flaw in Microsoft High Performance Computing (HPC) Pack where someone with a low-privilege network account can take higher control over the software; if you run this on a network with user accounts, you should act now.
Authenticated low-privilege users can exploit a Microsoft High Performance Computing (HPC) Pack process-handling weakness to gain unauthorized higher-level permissions via network access, enabling full control of the affected HPC Pack software.
If you're affected
Full control of HPC software
Service disruption
Data and capability takeover
Wider network impact
What is it
Imagine HPC Pack as a door inside your business that’s meant to let only certain staff into a secure room. This flaw lets a person who already has a regular (low-level) network account push past those limits, like walking through a locked door using an insider key.
Once they can do that, they may be able to take over how the software operates—potentially affecting your data and day-to-day operations tied to HPC Pack.
Who is affected
This matters if you run Microsoft High Performance Computing (HPC) Pack on a machine that is reachable from your network and you have user accounts that can authenticate to it.
It’s specifically a risk when an attacker has valid credentials for the system running HPC Pack; it does not require tricks like tricking a user into clicking something.
How urgent is it
This is RED because the weakness can be used by an attacker with valid low-privilege network credentials to gain higher permissions, and it’s reachable in the default configuration.
Even though no confirmed public exploit code is on record, your exposure depends on whether adversaries could obtain credentials; treat this as an active security risk that should be remediated immediately.
What to do — in detail
Confirm exposure (inventory + version check)
Identify whether you run Microsoft High Performance Computing (HPC) Pack for “windows app” or “Windows App Client for Windows Desktop”.
Check the installed version of HPC Pack on the relevant systems.
If the version is earlier than 2.0.1193.0, you are in the affected set based on the provided fixed-version information.
Upgrade to the fixed version
Target: upgrade both affected components (“windows app” and “Windows App Client for Windows Desktop”) to version 2.0.1193.0.
Coordinate with your IT owner/vendor because HPC-related environments can have operational dependencies.
If you can’t patch right away (temporary containment)
Reduce network exposure: limit which hosts can reach HPC Pack services.
Restrict authentication paths: allow only the required accounts/roles that must use HPC Pack.
Apply least privilege: remove unnecessary privileges from accounts that can authenticate to systems running HPC Pack.
Verify after remediation
Re-check the installed version(s) to confirm they are now at 2.0.1193.0.
Validate that normal HPC Pack operations still work as expected.
What to monitor
Look for suspicious authentication attempts and any abnormal activity around HPC Pack operations by accounts that should not normally perform elevated actions.
Timeline guidance
Because the verdict is RED and the flaw is reachable in default configuration with authenticated access, prioritize upgrading to 2.0.1193.0 as soon as possible in your next maintenance window (or earlier if you already have credible credential-risk).
Technical context
CVE-2026-59133 is an elevation-of-privilege issue (CWE-250) in Microsoft High Performance Computing (HPC) Pack. The stated mechanism is improper handling of certain processes such that an authorized attacker can gain higher-level permissions over the network.
Key findings-driven details:
Reachability: described as reachable in default configuration.
Authentication/interaction: requires an authenticated low-privilege account; no user interaction is required.
Preconditions: attacker must have valid credentials for the system running HPC Pack.
Impact: attackers can gain higher-level permissions, potentially resulting in full control over the affected HPC Pack software’s data/capabilities.
Exploitation and risk signals:
KEV listing: not listed in CISA KEV.
Public exploit code: none recorded.
Real-world press: no clear dated claim of exploitation.
Actor signal: PULSE notes “actor: Lazarus group” and “press attention: new, reason: patch.”
Fix information:
windows app: fixed in 2.0.1193.0
Windows App Client for Windows Desktop: fixed in 2.0.1193.0
Note on EPSS: a prediction was provided (0.9%); however, the primary remediation decision here is driven by the confirmed risk characteristics in the findings and the RED verdict.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
