CVE-2026-32184
Published: 14 April 2026
Summary
CVE-2026-32184 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Microsoft Hpc Pack. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 33.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32184 is a deserialization of untrusted data vulnerability (CWE-502) in the Microsoft High Performance Compute Pack (HPC). Published on 2026-04-14T18:17:21.777, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with low complexity and prerequisites.
The vulnerability enables a local, authorized attacker with low privileges to exploit deserialization flaws in HPC, resulting in privilege escalation. Successful exploitation grants high-level impacts on confidentiality, integrity, and availability, allowing the attacker to execute arbitrary code or manipulate system resources beyond their initial access level.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32184 details mitigation strategies and available patches for addressing this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22565
Vulnerability details
Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local deserialization vulnerability (CWE-502) in HPC Pack directly enables exploitation for privilege escalation from low-privileged context to arbitrary code execution with full CIA impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the deserialization vulnerability by requiring timely identification, reporting, and patching of the flaw in Microsoft HPC.
Prevents exploitation of deserialization of untrusted data by validating all relevant information inputs to the HPC system.
Limits the potential impact of local privilege escalation by enforcing least privilege for authorized low-privilege users.