CVE-2025-21198 is a critical Remote Code Execution vulnerability affecting Microsoft HPC Pack 2016 and 2019. This flaw allows an authenticated attacker on the adjacent network to execute arbitrary code with high privileges, leading to complete compromise of confidentiality, integrity, and availability. While not currently listed in CISA's KEV catalog and lacking public exploit code, it has garnered significant community discussion and media coverage, indicating a high level of awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2016.3CPE matchmatch criteria | cpe:2.3:a:microsoft:hpc_pack_2016:*:*:*:*:*:*:*:* | ||
< 6.3.8328.0CPE matchmatch criteria | cpe:2.3:a:microsoft:hpc_pack_2019:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.3 Reddit, 0.3 Bluesky, 0.4 Mastodon, and 2.6 GitHub mentions.
The average CVE in this peer group has 0.9 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.