Vulnerability · Published Mar 10, 2026 · Assigned by microsoft

CVE-2026-25166Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability

High 7.8

In plain English

A high-severity unsafe deserialization in Windows ADK for Windows 10, version 2004 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)1.9%top 20.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.

Affected products (as reported)

Vendor	Product	Versions
Microsoft	Windows ADK for Windows 10, version 2004	-
Microsoft	Windows ADK for Windows 11, version 22H2	-
Microsoft	Windows ADK for Windows 11, version 23H2	-
Microsoft	Windows ADK for Windows 11, version 24H2	-
Microsoft	Windows ADK for Windows Server 2022	-

Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

References

Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability vendor-advisory, patch