EUVD-2026-22534
GHSA-rg3f-46g9-qwc9
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.
AnalysisAI
Windows Hyper-V local privilege escalation via improper input validation (CWE-20) enables authenticated low-privilege attackers with user interaction to execute arbitrary code with high confidentiality, integrity, and availability impact across Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server (2016-2025). Microsoft released patches addressing the vulnerability with EPSS exploitation probability data not available; no public exploit identified at time of analys
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running Hyper-V (Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2016-2025) and categorize by criticality. Within 7 days: Test and deploy the vendor-released patch from Microsoft in a controlled environment; prioritize production Hyper-V hosts and servers hosting sensitive workloads. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today