CVE-2026-54120— Microsoft Surface Remote Code Execution Vulnerability
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Microsoft | Surface Management Services | - | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-54120
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Microsoft Surface Remote Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Microsoft Surface Management Services 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Surface Management Services是美国Microsoft公司的一款集中式IT设备管理解决方案。 Microsoft Surface Management Services存在输入验证错误漏洞，该漏洞源于输入验证不当，可能导致授权攻击者通过网络执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Microsoft | Surface Management Services | - | - |
II. Public POCs for CVE-2026-54120
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54120
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54120 (1)
Same Patch Batch · Microsoft · 2026-07-23 · 4 CVEs total
| CVE-2026-56165 | 9.8 CRITICAL | Microsoft Account Remote Code Execution Vulnerability |
| CVE-2026-56160 | 9.1 CRITICAL | Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability |
| CVE-2026-56167 | 8.5 HIGH | Azure AI Search Elevation of Privilege Vulnerability |
IV. Related Vulnerabilities
Same vendor: Microsoft
- CVE-2026-24301
Microsoft Copilot Information Disclosure Vulnerability - CVE-2026-73851
Kiota: Path traversal in generated plugin manifest static_te - CVE-2026-69414
Microsoft Defender Elevation of Privilege Vulnerability - CVE-2026-50523
Microsoft PowerShell Remote Code Execution Vulnerability - CVE-2026-72970
Microsoft Edge (Chromium-based) Remote Code Execution Vulner
Same weakness: CWE-20
- CVE-2026-52876
Streambert: Arbitrary File Execution via VLC/mpv Launcher Fa - CVE-2026-52877
Streambert : Insecure Protocol Execution in open-external IP - CVE-2026-15316
Denial-of-Service via Oversized Encrypted Credential Input i - CVE-2026-76035
Chrome Mac <151.0.7922.169 沙盒外代码执行漏洞 - CVE-2026-76033
Chrome<151.0.7922.169 CORS配置错误致站点隔离绕过
V. Comments for CVE-2026-54120
No comments yet