CVE-2026-59124: Microsoft HPC Pack RCE Vulnerability

CVE-2026-59124 Overview

CVE-2026-59124 is a critical deserialization vulnerability in Microsoft High Performance Computing (HPC) Pack. The flaw allows an unauthenticated attacker to execute arbitrary code over a network by submitting crafted serialized data to an exposed HPC Pack service. Microsoft classifies the weakness under [CWE-502]: Deserialization of Untrusted Data. Because HPC Pack coordinates job scheduling across compute clusters, successful exploitation can compromise the head node and pivot to worker nodes throughout the cluster.

Critical Impact
Unauthenticated remote code execution over the network with no user interaction required, providing full confidentiality, integrity, and availability compromise of the affected HPC Pack head node.

Affected Products

Microsoft High Performance Computing (HPC) Pack
Cluster head nodes running vulnerable HPC Pack services
Downstream compute nodes reachable from a compromised head node

Discovery Timeline

2026-08-11 - CVE-2026-59124 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-59124

Vulnerability Analysis

The vulnerability originates in how Microsoft HPC Pack processes serialized objects received over the network. HPC Pack exposes management and job-scheduling endpoints that accept serialized payloads from clients. When the service deserializes attacker-controlled data without validating the object graph, it instantiates arbitrary types and invokes methods during reconstruction.

Attackers can exploit this behavior with well-known .NET deserialization gadget chains. These chains coerce the deserializer into executing operating system commands during object rehydration. The attacker gains code execution in the security context of the HPC Pack service account, which typically holds elevated cluster-wide privileges.

The attack requires no authentication and no user interaction. HPC Pack is commonly deployed in research, engineering, and financial modeling environments where cluster head nodes may be reachable from internal networks or, in misconfigured deployments, the internet. EPSS scoring places the probability of exploitation activity at roughly 1.72 percent within 30 days, in the 75th percentile of tracked vulnerabilities.

Root Cause

The root cause is unsafe deserialization of untrusted input, tracked as [CWE-502]. The affected code paths call a binary or XML deserializer on data supplied by remote clients without applying type allow-lists, SerializationBinder restrictions, or authenticated transport requirements. This permits gadget-based type confusion that terminates in arbitrary command execution.

Attack Vector

Exploitation proceeds over the network against an exposed HPC Pack management endpoint. The attacker crafts a serialized payload containing a deserialization gadget chain, delivers it to the vulnerable service, and triggers execution during object reconstruction. No credentials, prior access, or user interaction are needed. Post-exploitation, the attacker inherits the privileges of the HPC service and can submit jobs, harvest credentials, or move laterally to compute nodes.

Refer to the Microsoft Security Update CVE-2026-59124 advisory for authoritative technical details.

Detection Methods for CVE-2026-59124

Indicators of Compromise

Unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by HPC Pack service processes on the head node.
Inbound network connections to HPC Pack management ports from untrusted or external source addresses.
New scheduled tasks, services, or job templates created on the head node outside change-control windows.
Outbound connections from HPC service accounts to unfamiliar hosts, indicating command-and-control or lateral movement.

Detection Strategies

Monitor process ancestry for HPC Pack services spawning script interpreters or living-off-the-land binaries.
Alert on .NET deserialization exceptions and unhandled type-load errors in HPC Pack application logs.
Correlate authentication anomalies on compute nodes with recent management traffic to the head node.

Monitoring Recommendations

Ingest HPC Pack service logs, Windows Security event logs, and Sysmon telemetry into a centralized SIEM for correlation.
Baseline normal HPC job submission patterns and alert on out-of-hours or high-volume submissions from new sources.
Track outbound egress from cluster head nodes; these systems should rarely initiate connections to the internet.

How to Mitigate CVE-2026-59124

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-59124 to all HPC Pack head and broker nodes.
Restrict network access to HPC Pack management endpoints so only trusted management subnets can reach them.
Audit HPC Pack service accounts and reduce privileges to the minimum required for cluster operation.
Review head node logs for signs of prior exploitation before returning systems to production.

Patch Information

Microsoft has issued a security update addressing CVE-2026-59124. Administrators should install the update on all HPC Pack head nodes, broker nodes, and client systems as identified in the Microsoft Security Update Guide. Verify successful patch installation and restart affected services where required.

Workarounds

Place HPC Pack management interfaces behind a VPN or jump host if immediate patching is not possible.
Use Windows Firewall or network ACLs to block inbound traffic to HPC Pack service ports from untrusted networks.
Disable or isolate any HPC Pack head node that must remain unpatched until the update can be applied.

bash

# Example: restrict inbound access to HPC Pack management ports on Windows
New-NetFirewallRule -DisplayName "Restrict HPC Pack Mgmt" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 5800,5801,5969,5970,5999,6729,7997,9087,9090,9091,9092,9093,9094 `
  -RemoteAddress 10.0.0.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "Block HPC Pack Mgmt (default)" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 5800,5801,5969,5970,5999,6729,7997,9087,9090,9091,9092,9093,9094 `
  -Action Block