Microsoft HPC Pack: Missing authentication leads to privilege escalation
Summary
Microsoft High Performance Computing (HPC) Pack contains a missing authentication check for a critical function. An unauthenticated attacker on the network may be able to elevate privileges. According to the CVSS vector, attack complexity is high, and Microsoft's exact preconditions could not be verified from the sources available. HPC Pack is a niche product for compute clusters, so most SMEs are unlikely to be affected.
Affected
- Microsoft HPC Pack 2019: 1.0.0 before 6.3.8364.
- Microsoft HPC Pack 2016: affected from 1.0.0 before the publication date given in the CVE record; the exact affected build is unknown.
Fixed in
- HPC Pack 2019: 6.3.8364 or later, according to the CVE record.
- HPC Pack 2016: Unknown. The vendor advisory could not be retrieved, so do not assume the 2019 build applies.
Workaround
Unknown. No vendor workaround was found in the sources. Until the patch is confirmed, restricting network access to HPC Pack management nodes is general hardening advice, not a vendor recommendation.
Exploitation
- Microsoft's CISA SSVC assessment lists exploitation as none and automatable as no.
- Rapid7 rates exploitation as less likely and lists no public disclosure.
- No in-the-wild exploitation or public proof of concept is known at this time.
Our recommendation
- Identify all HPC Pack 2016 and 2019 installations and their exact build numbers.
- Read the MSRC advisory to confirm the fixed HPC Pack 2016 build and any workaround.
- Make sure HPC Pack management ports are not reachable from the internet.
- Patch once the fixed build is confirmed, and verify it on every node.
- Do not treat HPC Pack as covered by Windows Updates alone; check it separately.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-122987 msrc.microsoft.com
- CVE Record CVE-2026-122987 www.cve.org
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Strix CVE summary CVE-2026-122987 www.strix.ai
- Lansweeper Patch Tuesday August 2026 www.lansweeper.com
- WindowsForum: CVE-2026-59133 HPC Pack patch not covered by Windows Updates windowsforum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:12.
Original description (NVD)
Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.