Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-66801: Microsoft Xbox can run attacker code remotely
CVE-2026-66801 · published 1 day ago
Summary
The Xbox Game Development Kit contains a flaw that lets an attacker send specially crafted data over the network and cause the system to run their own code. This could let an unauthorized user take control of the console or its services. Apply the latest Microsoft updates to the Xbox GDK as soon as they are available to fix the issue.
What to do
- Update microsoft microsoft gdk to version 2610 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft gdk | < 2610 |
Original advisory text
Microsoft Xbox Remote Code Execution Vulnerability
Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66801 vendor-advisory patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published10 Nov 2026
Updated12 Nov 2026
First seen10 Nov 2026
Track software like this
Free during beta