CVE-2026-21536: Microsoft Devices Pricing Program Remote Code Execution via File Upload

The Microsoft Devices Pricing Program web application accepted file uploads without restricting the file type. Server-executable files went through and were stored where the web server would run them.

An unauthenticated attacker uploads a web shell and executes code on the server. Microsoft rates it 9.8 Critical and fixed it before publishing the advisory on 5 March 2026.