Cyber Posture

CVE-2025-55232

CriticalRCE

Published: 09 September 2025

Published
09 September 2025
Modified
19 December 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0124 79.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-55232 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Microsoft Hpc Pack. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the CVE by requiring identification, reporting, and correction of the specific deserialization flaw through timely patching.

prevent

Prevents exploitation of deserialization of untrusted data by implementing input validation mechanisms at network entry points.

prevent

Mitigates arbitrary code execution from deserialization by protecting system memory from unauthorized code execution using safeguards like DEP and ASLR.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote unauthenticated deserialization RCE directly enables exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.

Deeper analysisAI

CVE-2025-55232 is a deserialization of untrusted data vulnerability (CWE-502) affecting Microsoft High Performance Compute Pack (HPC). Published on 2025-09-09, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote exploitation.

An unauthorized attacker can exploit this vulnerability over a network without privileges or user interaction, achieving arbitrary code execution with high confidentiality, integrity, and availability impacts.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55232 provides details on mitigation and patches.

Details

CWE(s)

Affected Products

microsoft
hpc pack
≤ 6.3.8352

CVEs Like This One

CVE-2026-32184Same product: Microsoft Hpc Pack
CVE-2025-53770Same vendor: Microsoft
CVE-2025-54897Same vendor: Microsoft
CVE-2025-49712Same vendor: Microsoft
CVE-2026-20963Same vendor: Microsoft
CVE-2025-59287Same vendor: Microsoft
CVE-2026-33819Same vendor: Microsoft
CVE-2025-59237Same vendor: Microsoft
CVE-2025-53772Same vendor: Microsoft
CVE-2026-26114Same vendor: Microsoft

References