Brief Summary: CVE-2026-33819, Critical Deserialization RCE in Microsoft Bing (CVSS 10.0)

Introduction

A maximum-severity deserialization vulnerability in Microsoft Bing's cloud infrastructure could have let an unauthenticated attacker gain remote code execution over the network, with no user interaction. The CVSS 10.0 rating draws attention, but the practical risk to end users is limited. Microsoft has confirmed the flaw was fully mitigated on its hosted infrastructure before public disclosure, and customers do not need to do anything.

The disclosure is part of Microsoft's Cloud Service transparency initiative, which proactively publishes CVEs for vulnerabilities in hosted services even after they have been resolved. The goal is to keep the security community informed. Operationally, though, these CVEs work very differently from traditional software vulnerabilities, which customers have to patch.

Technical Information

CVE-2026-33819 is classified under CWE-502: Deserialization of Untrusted Data. This class of vulnerability occurs when an application accepts serialized objects from an untrusted source and deserializes them without adequate validation. In distributed service architectures like the ones behind Bing, deserialization flaws are especially dangerous because the application assumes the incoming data stream is safe and instantiates objects from it directly. An attacker who controls the serialized payload can craft malicious objects that execute arbitrary code when they are deserialized.

CVSS Breakdown

The full CVSS 3.1 vector string is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

This gives a base score of 10.0, the maximum possible. Here is what each metric means:

Attack Vector: Network. An attacker can exploit the vulnerability remotely, with no physical or local access to the target system.

Attack Complexity: Low. The attack path is straightforward, with no specialized access conditions or extenuating circumstances needed.

Privileges Required: None. The attacker needs no authentication of any kind to trigger the vulnerability.

User Interaction: None. The exploit works without any user involvement, so it can be triggered autonomously.

Scope: Changed. After the base exploitability metrics, this one has the most consequence. A changed scope means the attacker can affect resources beyond the vulnerable component itself. For a cloud service like Bing, that could mean lateral movement, or impact on adjacent services that share the same infrastructure.

Confidentiality, Integrity, Availability: All High. A successful exploit could mean total loss of confidentiality (full information disclosure), total compromise of system integrity, and total loss of availability.

Attack Flow

Based on the vulnerability's characteristics, exploitation follows a pattern common to deserialization RCE flaws in network services:

1. An attacker identifies a network-accessible endpoint in the Bing service that accepts serialized data.
2. The attacker crafts a malicious serialized payload containing objects that trigger arbitrary code execution when deserialized.
3. The attacker sends the payload to the vulnerable endpoint over the network. No authentication or user interaction is required.
4. The Bing service deserializes the payload without proper validation and instantiates the attacker-controlled objects.
5. The code runs in the context of the service. The changed scope indicates potential impact beyond the initially vulnerable component.

The temporal score drops to 8.7 because exploit maturity is unproven (no public exploit code exists) and the vendor has confirmed remediation.

Affected Systems and Versions

The vulnerability affects Microsoft Bing as a hosted cloud service. Microsoft has designated it a vulnerability exclusive to the hosted service, so it does not affect any on-premises software, downloadable products, or customer-managed infrastructure. Microsoft has not publicly disclosed which internal components or versions were affected, in line with how it handles cloud service CVEs.

Vendor Security History

Microsoft Bing has had a notable cluster of critical remote code execution vulnerabilities in 2026. The independent security research firm XBOW identified multiple critical flaws in the platform earlier in the year:

Repeated deserialization and remote code execution flaws in Bing show how hard it is to secure a massive, AI-integrated search architecture. Microsoft's response has held up. Its bounty programs are active and awarded millions for vulnerability research in early 2026, and its Cloud Service transparency initiative still sets the industry standard for proactively disclosing mitigated cloud vulnerabilities.

References

• CVE-2026-33819: Microsoft Bing Remote Code Execution Vulnerability (MSRC)
• CVE Record: CVE-2026-33819 (MITRE)
• NVD Entry: CVE-2026-33819
• Microsoft Security Response Center: Cloud CVE Transparency
• Microsoft Bounty Programs
• XBOW: Three RCE Vulnerabilities in Microsoft
• GitHub Advisory: GHSA-qr6p-j8r5-cc78