CVE-2026-21536

CRITICAL

Microsoft Devices Pricing Program - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-21536. PoCs published by XiaomingX, b1gchoi.

AI-analyzed exploit summary The repository claims to provide a PoC for CVE-2026-21536 but lacks actual exploit code, instead redirecting users to an external download link (tinyurl). The README contains generic marketing language and no technical details about the vulnerability.

Description

Microsoft Devices Pricing Program Remote Code Execution Vulnerability

Exploits (2)

github SUSPICIOUS 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-21536

The repository claims to provide a PoC for CVE-2026-21536 but lacks actual exploit code, instead redirecting users to an external download link (tinyurl). The README contains generic marketing language and no technical details about the vulnerability.

Classification
Suspicious 95%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Microsoft Devices Pricing Program
No auth needed
Prerequisites: Python 3.8 or higher · Network access to target server
devstral-2 · analyzed Mar 11, 2026 Full analysis →
nomisec SUSPICIOUS
by b1gchoi · poc
https://github.com/b1gchoi/CVE-2026-21536-RCE

The repository claims to provide a PoC for CVE-2026-21536 but lacks actual exploit code, instead directing users to an external download link (tinyurl.com). The README contains generic marketing language and no technical details about the vulnerability.

Classification
Suspicious 95%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Microsoft Devices Pricing Program
No auth needed
Prerequisites: Python 3.8 or higher · Network access to target server
devstral-2 · analyzed Mar 11, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0170
EPSS Percentile 82.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-434
Status published
Products (2)
microsoft/devices_pricing_program
Microsoft/Microsoft Devices Pricing Program -
Published Mar 05, 2026
Tracked Since Mar 06, 2026