NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
CRITICAL severity

CVE-2026-66801 — Microsoft

CRITICAL

CVE-2026-66801 is a critical-severity (CVSS 9.8) CWE-122 vulnerability. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.

Published
Updated
Affected
—
Patched
—
Exploits
None indexed
Exploitation data as of Nov 11, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.1%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs67th percentile — riskier than 67% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Description

Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Remediation status

    The records we use list no fixed release for CVE-2026-66801. Check the upstream advisory for a patched version, and apply the exposure-reduction steps below in the meantime.

  3. Mitigate without a patch

    Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatCritical

Critical: The default Strimzi transport in Multicluster Global Hub is vulnerable to privilege escalation. A compromised managed hub can exploit weak Kafka Write ACLs on the shared `gh-spec` topic and spoofed CloudEvent sources to gain cluster-admin privileges across the entire fleet of managed hubs. This allows an…

Workaround published by Red Hat
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Source: Red Hat security advisory for CVE-2026-66801 (CC BY 4.0)
ProductFixed inAdvisory
Multicluster Global Hub 1.4.9multicluster-globalhub/multicluster-globalhub-rhel9-operator:1786621416RHSA-2026:55810
Multicluster Global Hub 1.5.8multicluster-globalhub/multicluster-globalhub-rhel9-operator:1786621343RHSA-2026:54577
Multicluster Global Hub 1.6.6multicluster-globalhub/multicluster-globalhub-rhel9-operator:1786071343RHSA-2026:54392
Multicluster Global Hub 1.7.4multicluster-globalhub/multicluster-globalhub-rhel9-operator:1785773214RHSA-2026:53530
Multicluster Global Hub 1.8.2multicluster-globalhub/multicluster-globalhub-rhel9-operator:1786067967RHSA-2026:52946

Frequently Asked Questions

Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.
O3 Security · Impact-Aware SCA

Is CVE-2026-66801 in your dependencies?

Find it across your dependency tree, including transitive dependencies.

Scan my dependencies How O3 SCA works