This vulnerability (CVE-2026-21536) in the Microsoft Devices Pricing Program is classified under CWE-434, which involves unrestricted upload of files with dangerous types. An attacker can exploit this flaw remotely without authentication or user interaction to execute arbitrary code on the affected system. The CVSS 3.1 base score is 9.8, reflecting critical severity with full impact on confidentiality, integrity, and availability. The vulnerability is publicly known and published, and a patch is available from Microsoft to remediate the issue.

Successful exploitation of this vulnerability can lead to remote code execution, allowing attackers to gain full control over the affected system. This compromises confidentiality, integrity, and availability of the system and any data processed by the Microsoft Devices Pricing Program.

A patch is available for this vulnerability. It is recommended to apply the official Microsoft update promptly to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch to affected installations. No additional vendor advisory content is provided, so verify patch details from Microsoft’s official security updates.