CVE-2026-54120

50th percentile - higher than 50% of all known CVEs

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.

An authorized attacker can execute arbitrary code on the vulnerable Surface device, potentially leading to privilege escalation and system integrity compromise.

Apply the security update provided by Microsoft for affected versions of Microsoft Surface.