CVE-2026-84452 microsoft CVE debrief

Who should care

Users of the Windows ML CLI tool, particularly those who use the tool in a server environment, should be aware of this vulnerability and take steps to mitigate it. Additionally, security teams and administrators responsible for monitoring and patching vulnerabilities should prioritize this issue due to its high CVSS score and potential for exploitation.

Technical summary

The Windows ML CLI tool is vulnerable to arbitrary code execution due to a lack of authentication and validation in the localhost HTTP API. The src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands without authentication, allowing a malicious website to send cross-origin requests and set the trust_remote_code parameter to true, leading to code execution as the server user. This issue is fixed in version 0.4.0.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows for arbitrary code execution.

Recommended defensive actions

• Verify and apply the patch to update the Windows ML CLI tool to version 0.4.0 or later.
• Restrict access to the localhost HTTP API to prevent unauthorized requests.
• Monitor for suspicious activity and implement compensating controls to detect potential exploitation attempts.
• Review system logs for signs of exploitation.
• Implement additional security measures such as network segmentation.
• Conduct a thorough risk assessment to identify potential vulnerabilities.
• Develop an incident response plan in case of exploitation.

Evidence notes

Evidence from the CVE Program and NVD suggests that the Windows ML CLI tool is vulnerable to arbitrary code execution due to a lack of authentication and validation in the localhost HTTP API. The src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands without authentication, allowing a malicious website to send cross-origin requests and set the trust_remote_code parameter to true, leading to code execution as the server user.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.