Microsoft HPC Pack Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft High Performance Compute (HPC) Pack) 2016 and 2019. This vulnerability allows an attacker with access to the same network as the targeted clusters or nodes to send a specially crafted HTTPS request to the head node or a Linux compute node, potentially leading to unauthorized code execution on other connected clusters or nodes.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected head node or Linux compute node, with the potential to execute code on other clusters or nodes connected to the targeted head node.

Remediation

Users can apply the security update available through the Microsoft Update Catalog. Instructions for downloading this update can be found in the release notes for HPC Pack 2016 Update 3 and HPC Pack 2019 Update 3.