CVE-2026-66801

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66801", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-07-27T19:02:26.600Z", "datePublished": "2026-11-10T18:15:11.985Z", "dateUpdated": "2026-11-12T21:42:23.149Z"}, "containers": {"cna": {"title": "Microsoft Xbox Remote Code Execution Vulnerability", "datePublic": "2026-11-10T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:microsoft_gdk:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0.0", "versionEndExcluding": "2610"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft GDK", "platforms": ["Xbox"], "versions": [{"version": "1.0.0.0", "lessThan": "2610", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-122: Heap-based Buffer Overflow", "lang": "en-US", "type": "CWE", "cweId": "CWE-122"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-12T21:42:23.149Z"}, "references": [{"name": "Microsoft Xbox Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66801"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T21:14:32.599772Z", "id": "CVE-2026-66801", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T21:14:44.002Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66801", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-10T21:14:32.599772Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T21:14:39.979Z"}}], "cna": {"title": "Microsoft Xbox Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft GDK", "versions": [{"status": "affected", "version": "1.0.0.0", "lessThan": "2610", "versionType": "custom"}], "platforms": ["Xbox"]}], "datePublic": "2026-11-10T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66801", "name": "Microsoft Xbox Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:microsoft_gdk:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2610", "versionStartIncluding": "1.0.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T23:46:36.319Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66801", "state": "PUBLISHED", "dateUpdated": "2026-11-10T23:46:36.319Z", "dateReserved": "2026-07-27T19:02:26.600Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-11-10T18:15:11.985Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"platforms": ["Xbox"], "product": "Microsoft GDK", "vendor": "Microsoft", "versions": [{"lessThan": "2610", "status": "affected", "version": "1.0.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network."}], "id": "CVE-2026-66801", "lastModified": "2026-11-10T22:19:15.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66801", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T21:14:32.599772Z", "version": "2.0.3"}}]}, "published": "2026-11-10T19:21:17.250", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66801"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:52946", "cpe": "cpe:/a:redhat:multicluster_globalhub:1.8::el9", "impact": "critical", "package": "multicluster-globalhub/multicluster-globalhub-rhel9-operator:1786067967", "product_name": "Multicluster Global Hub 1.8.1", "release_date": "2026-08-10T00:00:00Z"}], "bugzilla": {"description": "multicluster-global-hub: multicluster-global-hub: shared Kafka gh-spec topic Write ACL plus spoofable CloudEvent source enables fleet-wide cluster-admin from any compromised managed hub", "id": "2508045", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508045"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-290", "details": ["A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent (a specification for describing event data in a common way) message to the shared `gh-spec` topic. This message can spoof its source as \"global-hub\" and target other managed hubs. Due to a lack of binding between the Kafka client principal and the CloudEvent envelope, the agent on the targeted hub accepts this spoofed message and applies arbitrary resources. This vulnerability allows for fleet-wide cluster-admin privilege escalation across all managed hubs."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-66801", "public_date": "2026-08-10T13:40:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-66801\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66801"], "statement": "Critical: The default Strimzi transport in Multicluster Global Hub is vulnerable to privilege escalation. A compromised managed hub can exploit weak Kafka Write ACLs on the shared `gh-spec` topic and spoofed CloudEvent sources to gain cluster-admin privileges across the entire fleet of managed hubs. This allows an attacker to achieve fleet-wide administrative control from a single compromised leaf hub.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.8"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "multicluster_globalhub", "vendor": "redhat"}], "created": "2026-08-11T01:45:06.847719+00:00", "updated": "2026-08-11T05:00:09.078555+00:00", "vendors": ["redhat", "redhat$PRODUCT$multicluster_globalhub"]}