CVE-2026-122987: Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability

Q: Which deployments are identified as affected?

The affected software listed is Microsoft HPC Pack 2016 and Microsoft HPC Pack 2019.

Q: Does exploitation require an authenticated account or user interaction?

No. The vector indicates network-based exploitation with no privileges required and no user interaction required.

Q: What security impact is described?

An unauthorized attacker may be able to elevate privileges. The supplied metrics indicate high confidentiality impact, with no integrity or availability impact listed.

Q: How difficult is exploitation expected to be?

The supplied metrics rate attack complexity as high, indicating exploitation requires conditions beyond simple network reachability.

Published Nov 10, 2026

Updated

Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability

Other sources

Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network.

— Microsoft

Affected Software

2 affected componentsFixes available

Microsoft HPC Pack 2016

Microsoft HPC Pack 2019<6.3.8364

6.3.8364

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.8364

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:22 PM

Data Sourced

via MITRE·06:22 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are identified as affected?

The affected software listed is Microsoft HPC Pack 2016 and Microsoft HPC Pack 2019.

Does exploitation require an authenticated account or user interaction?

No. The vector indicates network-based exploitation with no privileges required and no user interaction required.

What security impact is described?

An unauthorized attacker may be able to elevate privileges. The supplied metrics indicate high confidentiality impact, with no integrity or availability impact listed.

How difficult is exploitation expected to be?

The supplied metrics rate attack complexity as high, indicating exploitation requires conditions beyond simple network reachability.

CVE-2026-122987: Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are identified as affected?

Does exploitation require an authenticated account or user interaction?

What security impact is described?

How difficult is exploitation expected to be?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are identified as affected?

Does exploitation require an authenticated account or user interaction?

What security impact is described?

How difficult is exploitation expected to be?