Update (July 7, 2025): Activision has since pulled the "Xbox PC" version of Call of Duty: WWII. This was the version of the game that was available through PC Game Pass. Call of Duty: WWII is still available on Steam and Battle.net, but I probably wouldn't test either of those out if I were you. There's no saying yet if those versions are also vulnerable.
Original: Call of Duty: WWII was added to PC Game Pass on June 30, 2025. Just two days later on July 2nd, players reported that they were being hacked in the middle of their games via an unpatched Remote Code Execution (RCE) exploit. This means that a vulnerability in the game allows bad actors to remotely run code on victim's machines.
Reports of this major security issue were compiled by CyberInsider.com. They shared reports of players and streamers that documented how attackers took control of their systems during multiplayer matches. The attacks ranged from the bad actors forcing their victim's PC to shut down, to to displaying explicit content on a secondary monitor. Some players report having the hackers spoof their Gamertags and forcing them to disconnect from online game sessions.
It seems as though the Game Pass release does not include any added security measures. According to the CyberInsider report, researchers found RCE vulnerabilities in most of the older Call of Duty titles. These vulnerabilities were due to the older Call of Duty titles "using outdated networking models or insufficient input sanitization."
It was assumed that a modern release of the game would include security patches, but that does not seem to be the case. Other Call of Duty titles that recently hit Game Pass, such as Call of Duty: Black Ops 3, did receive security updates. For whatever reason, Call of Duty: WWII did not include those same updates.
To date, Activision has not issued any public statement addressing the alleged RCE vulnerabilities in WWII. Ten Call of Duty games were briefly taken offline for maintenance earlier today, including WWII, but there’s no confirmation this was in response to the reported hacks. The scope of the issue remains unclear, and there’s no confirmation on whether all affected users were running unmodified versions of the game or if third-party tools could have played a role. None of the victims have indicated use of custom mods or software that could explain the attacks, suggesting the vulnerability may reside in the base game or the Game Pass release itself.
I didn't list Infinite Warfare as I played MP for about 15 minutes. That game's a Yikes from me.The campaign was kind of cool, though.