What is the CVSS score of CVE-2026-40402?

CVE-2026-40402 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows Hyper-V are affected by CVE-2026-40402?

Microsoft Windows Hyper-V contains a critical local privilege escalation vulnerability (CVE-2026-40402) affecting Windows 11 and Server 2022 that enables guest virtual machines to escape containment…. A patch is available.

How to fix or mitigate CVE-2026-40402?

Within 24 hours, inventory all Windows 11 (versions 22H3 and 23H2) and Windows Server 2022 systems running Hyper-V, prioritizing production virtualization hosts and documenting guest VM dependencies. Within 7 days, apply Microsoft's released security patch to all affected systems, beginning with production environments and staggering updates to maintain business continuity. Within 30 days, complete patch deployment across all affected infrastructure, validate successful updates through patch management tools, implement guest-to-host monitoring controls, and document remediation completion in your vulnerability management system.

Windows Hyper-V CVE-2026-40402

EUVD-2026-29663 CRITICAL

Use After Free (CWE-416)

2026-05-12 microsoft

GHSA-h659-hh52-mv97

Denial Of Service Memory Corruption Microsoft Use After Free Windows 11 Version 22H3 Windows 11 Version 23H2 Windows Server 2022

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Attacker must run code in a guest (AV:L, PR:L), no interaction needed (UI:N); guest-to-host escape justifies S:C with total C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:14 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

CRITICAL 9.3

DescriptionCVE.org

Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Hyper-V (Windows 11 22H3/23H2 and Windows Server 2022) stems from a use-after-free memory corruption flaw that lets an attacker executing code in a guest context elevate privileges with a scope-changing impact on the host. Microsoft has released fixed builds and rates this critical (CVSS 9.3, total technical impact per CISA SSVC), but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). The scope change (S:C) combined with the Hyper-V attack surface is consistent with a guest-to-host virtualization boundary escape.

Technical ContextAI

Hyper-V is Microsoft's type-1 (bare-metal) hypervisor that partitions a host into isolated guest virtual machines; the security boundary between a guest and the host root partition is one of the most sensitive in Windows. The root cause is CWE-416 (Use After Free): a kernel/hypervisor object is freed while a dangling reference remains, and subsequent reuse of that freed memory allows an attacker to corrupt control data or object pointers. In a virtualization stack this class of bug is dangerous because manipulating freed host-side objects from guest-triggered code paths can break VM isolation. Per the CPE data the affected components are Microsoft Windows 11 version 22H3, Windows 11 version 23H2, and Windows Server 2022 - all shipping the same vulnerable Hyper-V virtualization stack.

RemediationAI

Vendor-released patch: apply the Microsoft cumulative update raising builds to at least 10.0.20348.5139 on Windows Server 2022 and 10.0.22631.7079 on Windows 11 22H3/23H2, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40402. Because exploitation requires code execution in a guest context, the most effective compensating control until patching is to restrict who can run untrusted workloads inside Hyper-V VMs - avoid hosting untrusted or multi-tenant guests on unpatched hosts, and where feasible temporarily consolidate untrusted guests onto already-patched hosts (trade-off: migration overhead and reduced capacity). Where Hyper-V is not required, disabling the Hyper-V role removes the attack surface entirely (trade-off: breaks any dependent virtualization, WSL2, or container features). Additional advisory references: https://vuldb.com/vuln/363194 and https://nvd.nist.gov/vuln/detail/CVE-2026-40402.