What is the CVSS score of CVE-2026-42972?

CVE-2026-42972 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-42972?

Yes, a patch is available for CVE-2026-42972. Update the affected software to the latest version immediately.

Windows Hyper-V CVE-2026-42972

EUVD-2026-35729 MEDIUM

Information Exposure (CWE-200)

2026-06-09 secure@microsoft.com

GHSA-6g3f-j7jw-9v65

Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

5.5

CVSS 3.1 · Vendor: microsoft

Temporal: 4.8

Severity by source

Vendor (microsoft) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

4.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:56 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

MEDIUM 5.5

DescriptionCVE.org

Exposure of sensitive information to an unauthorized actor in Windows Hyper-V allows an authorized attacker to disclose information locally.

AnalysisAI

Local information disclosure in Windows Hyper-V enables an authenticated low-privileged attacker to access sensitive data they are not authorized to read, without any user interaction. Affected systems span a broad range of Windows desktop and server editions from Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis and no CISA KEV listing; however, the high confidentiality impact (C:H) and breadth of affected versions make this a meaningful patching priority, particularly in multi-tenant virtualization environments.

Technical ContextAI

Windows Hyper-V is Microsoft's native Type-1 hypervisor, present across both client and server Windows SKUs. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as improper access control or inadequate isolation in how Hyper-V surfaces information to lower-privileged callers - potentially exposing hypervisor-managed memory regions, guest VM state, or host kernel data structures to a low-privileged local process. The attack vector (AV:L) and scope (S:U) confirm this is a local, non-hypervisor-escape issue confined to the affected system's privilege boundary. Affected CPE contexts span Windows NT kernel builds from 6.2.x (Server 2012) through 10.0.28000.x (Windows 11 26H1), confirming the flaw exists across multiple generations of the Hyper-V implementation.

RemediationAI

Apply the vendor-released security update addressing CVE-2026-42972 via Windows Update, WSUS, or Microsoft Update Catalog as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42972. Target build versions per platform are: Server 2012 ≥6.2.9200.26132, Server 2012 R2 ≥6.3.9600.23228, Server 2016/Windows 10 1607 ≥10.0.14393.9234, Server 2019/Windows 10 1809 ≥10.0.17763.8880, Server 2022 ≥10.0.20348.5256, Server 2025/Windows 11 24H2 ≥10.0.26100.32995 (Server 2025) or 10.0.26100.8655 (Win11 24H2), Windows 11 23H2 ≥10.0.22631.7219, Windows 11 25H2 ≥10.0.26200.8655, Windows 11 26H1 ≥10.0.28000.2269. If patching is not immediately possible, consider restricting local interactive logon rights on Hyper-V hosts to the minimum necessary administrative accounts, which reduces the pool of users who could trigger the disclosure. Disabling Hyper-V entirely is an option only if the role is not operationally required, as it will break all hosted VMs. Note that the patch scope is exact fixed builds per SKU; partial updates may leave sub-components vulnerable.