Windows Hyper-V CVE-2026-40402

Exploitation requires the Hyper-V role to be enabled and the attacker to already be able to execute code locally, in practice within a guest VM whose crafted operations reach the vulnerable host-side Hyper-V code path (use-after-free). What limits exploitation: it is not remotely reachable (AV:L), it is not automatable per CISA SSVC, and it is irrelevant to systems that do not run Hyper-V or that only host fully trusted guests. Although CVSS marks PR:N, the practical prerequisite of running code inside a guest means untrusted-guest deployments are the real exposure - verify the exact privilege requirement against Microsoft's advisory.

The signals are mixed and worth reconciling. CVSS is 9.3 critical with AV:L/AC:L/PR:N/UI:N and a scope change (S:C), and CISA SSVC rates Technical Impact as 'total' - consistent with a full guest-to-host compromise. However, SSVC also records Exploitation: none and Automatable: no, and EPSS is only 0.04% (14th percentile), so despite the high CVSS this is not currently seeing exploitation and is not mass-exploitable. The vector is local (AV:L), meaning an attacker must already run code somewhere on the system/guest, which materially lowers real-world urgency versus a remote-unauthenticated bug. One tension to flag: the CVSS marks PR:N ('unauthorized attacker'), yet a Hyper-V elevation realistically requires the ability to execute code within a guest VM - verify the intended privilege prerequisite with Microsoft's advisory. Net: a genuine high-priority patch for hosts running Hyper-V with untrusted guests, but not an emergency for systems without multi-tenant or untrusted virtualization workloads.

An attacker who has already gained code execution inside a Hyper-V guest VM (e.g., a low-privilege tenant or a compromised workload) triggers the use-after-free in the host-side virtualization stack, reusing freed memory to corrupt a host object and elevate to SYSTEM/host privileges, breaking VM isolation. No public exploit identified at time of analysis, and the local attack vector with low complexity (AV:L/AC:L) means no user interaction is needed once the attacker has that foothold.