CVE-2026-21536

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 1.60%
EPSS Percentile: 76.00%
CISA KEV: Not listed

Description

Microsoft Devices Pricing Program Remote Code Execution Vulnerability

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 06-Mar-2026 06:16
Last Modified: 17-Jun-2026 17:18
EPSS Date: 2026-11-08
CWE: CWE-434

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Microsoft · Microsoft Devices Pricing Program Source: CNA · [email protected]
Default status: unknown

- — affected

Affected Products / Versions

microsoft / devices_pricing_program Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:microsoft:devices_pricing_program:-:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 09-Nov-2026 14:43
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

Notable fixes include a mitigated CVE-2026-21536 (9.8 RCE) in the Microsoft Devices Pricing Program discovered by XBOW, a Winlogon privilege escalation CVE-2026-25187 reported by James Forshaw, and an Azure MCP SSRF Microsoft Patches 84 Vulnerabilities in May 2026 Update, Including Two Publicly Disclosed Zero-Days
Microsoft’s March 2026 Patch Tuesday updates resolve a single critical-severity flaw, namely CVE-2026-21536 (CVSS score of 9.8), a remote code execution weakness in Devices Pricing Program that has already been fully Microsoft Patches 83 Vulnerabilities in March 2026 Update

CVE (10)

People (5)

MITRE ATT&CK (2)

Vendors (1)

Products (19)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.