CVE-2026-21536
Published: 05 March 2026
Summary
CVE-2026-21536 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Microsoft Devices Pricing Program. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21536 is a Remote Code Execution vulnerability in the Microsoft Devices Pricing Program. Published on 2026-03-05T23:16:18.447, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 and NVD-CWE-noinfo.
The vulnerability enables remote exploitation over the network by unauthenticated attackers requiring low attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing arbitrary code execution on affected systems.
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21536.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9885
Vulnerability details
Microsoft Devices Pricing Program Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-21536 is a network-accessible, unauthenticated RCE vulnerability in a Microsoft service, directly enabling exploitation of public-facing applications (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the RCE vulnerability in Microsoft Devices Pricing Program by requiring timely patching and flaw remediation as per MSRC guidance for CVE-2026-21536.
Identifies CVE-2026-21536 through vulnerability scanning and monitoring, enabling proactive remediation before remote exploitation.
Prevents unauthenticated remote attacks on the vulnerable service by enforcing boundary protections that restrict network access to the Microsoft Devices Pricing Program.