CVE-2026-84452: CVE-2026-84452: Localhost Remote Code Execution via CORS Misconfiguration in Windows ML CLI

#security #cve #cybersecurity

CVE-2026-84452: Localhost Remote Code Execution via CORS Misconfiguration in Windows ML CLI

Vulnerability ID: CVE-2026-84452
CVSS Score: 8.6
Published: 2026-09-08

A critical vulnerability (CVE-2026-84452) in the Windows ML CLI (winml-cli) HTTP server component allows unauthenticated remote code execution via permissive CORS and lack of request validation.

TL;DR

Unauthenticated remote code execution in winml-cli before 0.4.0 via CORS wildcard and lack of loopback verification.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-942, CWE-306
Attack Vector: Network (via Browser Cross-Origin Request)
CVSS v4.0 Score: 8.6
EPSS Score: 0.00945 (58.83rd percentile)
Impact: Remote Code Execution
Exploit Status: Proof of Concept
KEV Status: Not Listed

Affected Systems

Windows ML CLI (winml-cli)
winml-cli: < 0.4.0 (Fixed in: 0.4.0)

Code Analysis

Commit: f4073e0

Restrict cross-origin access and context boundaries in winml-cli

Mitigation Strategies

Upgrade to winml-cli 0.4.0 or higher
Implement browser Private Network Access controls
Shut down local dev servers when not in use

Remediation Steps:

Run pip install --upgrade winml-cli>=0.4.0
Configure workstation firewall to block incoming external connections to localhost ports
Enable PNA on enterprise browsers

References

Read the full report for CVE-2026-84452 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community