CVE-2026-54120
A flaw in Microsoft Surface lets an attacker who can send data to the device run arbitrary code over the network. The vulnerability is due to improper input validation and could allow a malicious actor to take full control of the Surface device.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Surface devices (no specific models or firmware versions are listed).
Real-world impact
An attacker who can reach the Surface device over the network could run any code they choose, potentially taking full control of the device, stealing data, or using it as part of a larger attack.
Why this severity
The CVSS score of 9.9 reflects that the attack can be performed over the network (AV:N), requires only low effort (AC:L) and low privileges (PR:L), no user interaction (UI:N), and the impact is complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources