CVE-2026-23654
Published: 10 March 2026
Summary
CVE-2026-23654 is a high-severity an unspecified weakness vulnerability in Microsoft Zero-Shot-Scfoundation. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 43.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23654, published on 2026-03-10T18:18:13.743, is a vulnerability arising from a dependency on a vulnerable third-party component in the GitHub repository zero-shot-scfoundation. This flaw enables an unauthorized attacker to execute code over a network. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is categorized under NVD-CWE-noinfo.
The vulnerability can be exploited by an unauthorized attacker with network access and no required privileges, provided they can induce user interaction, such as clicking a link or opening a malicious file. Successful exploitation grants the attacker high-impact capabilities, including unauthorized disclosure of confidential information, modification of data or system integrity, and denial of availability through remote code execution.
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23654.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10577
Vulnerability details
Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE via vulnerable third-party dependency with UI:R maps to client-side exploitation (T1203) and supply-chain compromise (T1195.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of flaws like the vulnerable third-party component in CVE-2026-23654 to prevent remote code execution.
Enables regular vulnerability scanning to identify the presence of the exploitable third-party dependency in CVE-2026-23654.
Maintains an inventory of system components, including third-party dependencies, to facilitate detection and remediation of vulnerabilities like CVE-2026-23654.