Windows Server 2016 CVE-2026-26156

User interaction required — victim must open attacker-supplied file locally on Windows system with Hyper-V enabled. No authentication required but depends on user executing the malicious payload.

Despite the high CVSS score of 7.8, real-world exploitation risk requires careful contextualization of multiple signals. The local attack vector (AV:L) significantly constrains threat scenarios compared to network-exploitable vulnerabilities, requiring the attacker to already have local access to a Hyper-V host system or control a guest VM. The UI:R requirement introduces an additional barrier, demanding user interaction such as opening a malicious file or executing a crafted application. No public exploit identified at time of analysis and absence from CISA KEV indicates this is not being actively exploited in the wild. However, the low attack complexity (AC:L) and no privileges required (PR:N) suggest that once technical details become public, reliable exploitation code could be developed. The vulnerability's severity is amplified in cloud/multi-tenant environments where Hyper-V provides security boundaries between customer workloads-successful exploitation could enable VM escape or host compromise. Organizations running Hyper-V in production should prioritize patching, but the local-only attack surface and user interaction requirement place this below actively exploited remote code execution vulnerabilities in urgent remediation priority. The availability of vendor patches across all affected versions and the 4-month disclosure window (typical Microsoft Patch Tuesday cadence) provide adequate remediation runway before exploit code likely emerges.

Attacker sends crafted file to target user. When opened, it triggers heap buffer overflow in Hyper-V component, executing arbitrary code with user privileges. Requires local access and user interaction.