What is the CVSS score of CVE-2026-57092?

CVE-2026-57092 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Windows Hyper-V are affected by CVE-2026-57092?

A critical vulnerability in Windows Hyper-V allows attackers operating within a guest virtual machine to escape and gain complete control of the host system, affecting all organizations running…. A patch is available.

How to fix or mitigate CVE-2026-57092?

Within 24 hours, identify all systems running Windows Hyper-V across your infrastructure, including Windows 10 (1607 through current), Windows 11, and Windows Server (2012 through 2025), and catalog which systems host production workloads or untrusted guest VMs. Within 7 days, apply the vendor patch available per Microsoft security advisory to non-production Hyper-V hosts to validate compatibility with your virtualization stack and dependent workloads. Within 30 days, complete patching of all Hyper-V systems in production environments following your standard change management procedures, prioritizing hosts supporting shared, multi-tenant, or guest environments from untrusted sources.

Windows Hyper-V CVE-2026-57092

EUVD-2026-44271 CRITICAL

Use After Free (CWE-416)

2026-07-14 microsoft

GHSA-7gm6-68gc-836h

Denial Of Service Use After Free Memory Corruption Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

9.9

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.0 HIGH

Guest-to-host path is adjacent rather than truly remote (AV:A), UAF needs a memory-reuse race (AC:H), and a guest foothold is required (PR:L), with full host impact and scope change.

3.1 AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:58 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

CRITICAL 9.9

DescriptionCVE.org

Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating from a guest partition corrupt kernel memory via a use-after-free and gain higher privileges, with a scope change (S:C) indicating a guest-to-host escape. Rated CVSS 9.9 and affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, this issue was reported by Microsoft and has a vendor patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

VMSwitch is the kernel-mode virtual network switch driver (vmswitch.sys) at the heart of Hyper-V networking, brokering all virtual NIC traffic between guest VMs, the host partition, and physical adapters. The flaw is a CWE-416 use-after-free: a memory object is freed while a reference to it remains reachable, so a later access operates on freed or reallocated memory. In a kernel-mode virtualization component, controlling the contents of the reclaimed allocation can yield arbitrary kernel read/write and hijacked execution. The reported scope change reflects that code executing in the security context of a guest partition can affect the more-privileged host partition, which is the defining risk of Hyper-V virtual-switch bugs.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security updates for CVE-2026-57092 to every affected client and server SKU via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092, prioritizing Hyper-V hosts and any Windows Server systems running the Hyper-V role. Because exploitation requires a guest foothold reaching VMSwitch, interim compensating controls include hardening tenant/guest isolation and restricting who can create or run untrusted VMs on shared hosts; on systems where the Hyper-V role is not needed, disabling the role removes VMSwitch entirely (trade-off: eliminates all virtualization on that host). Where VMs are required, limit guest network exposure and monitor for anomalous host-partition behavior until patching completes - note these controls reduce but do not eliminate the guest-to-host attack surface, so patching remains the only complete fix.