CVE-2026-59124

CVE-2026-59124 is a deserialization of untrusted data flaw (CWE-502) in Microsoft High Performance Computing (HPC) Pack that allows an unauthorized attacker to execute code over a network. Because the vulnerable component processes untrusted serialized input, an attacker who can reach the network-facing service can send malicious serialized data and trigger arbitrary code execution without credentials or user interaction. Successful exploitation grants the attacker the ability to run code in the context of the affected service, with full confidentiality, integrity, and availability impact per the 9.8 CVSS score. Any organization running Microsoft HPC Pack on Windows — typically head nodes and management endpoints of Windows HPC clusters — is affected. As of the August 2026 Patch Tuesday release that addressed it, there is no known public proof-of-concept, no CISA KEV listing, and no confirmed exploitation in the wild, though the EPSS score of 1.7% (76th percentile) suggests a moderate near-term exploitation probability.

What to do: Apply Microsoft's August 2026 security updates for HPC Pack immediately via Windows Update or the Microsoft Update Catalog, since the flaw is remotely exploitable without authentication. Inventory your environment for HPC Pack head nodes and management services, and restrict network access to them (firewall rules, VPN, or jump hosts) until patched. Because the vector is unauthenticated network code execution, prioritize internet-facing or broadly reachable cluster endpoints when patching.