Windows Hyper-V CVE-2026-69603

The attacker must have low-privileged code execution inside a Windows Hyper-V guest virtual machine (PR:L per CVSS vector). The vulnerability is exploited locally - no network path to the target is required, as the attack surface is the hypervisor's guest-to-host interface. The Hyper-V role must be enabled and running on the host; Windows systems without Hyper-V active are not exposed. No user interaction on the host is required (UI:N). The scope change (S:C) indicates that successful exploitation crosses from the guest VM security boundary into the host. Exploitation is limited to authorized users who can run or interact with a guest VM on the affected host - pure external network attackers without prior guest-VM access cannot exploit this directly.

This is a high-priority vulnerability in enterprise and cloud environments. The CVSS 8.8 score (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects low local complexity with no interaction needed once inside a guest VM, and full host compromise on success. The scope-change and full C/I/A triad represent worst-case hypervisor impact - an attacker breaking out of a guest can read or destroy all other VMs, steal encryption keys or credentials stored on the host, pivot to the management network, and persist below the OS. In multi-tenant environments (shared Hyper-V hosts, Azure Stack, hosted VDI), a single compromised tenant VM could laterally compromise all co-hosted workloads. No EPSS score was provided in the input data, so exploitation probability cannot be quantitatively compared. No CISA KEV listing or public POC has been identified, which slightly reduces urgency for opportunistic attack scenarios, but the low exploitation complexity means that any threat actor capable of running guest code (e.g., via phishing, supply-chain compromise, or insider access) can weaponize this without sophisticated tooling. Organizations running shared Hyper-V hosts or using Hyper-V for security boundaries (e.g., DeviceGuard, Windows Sandbox, WSL2) should treat this as critical.

An attacker who has gained low-privileged code execution inside a Hyper-V guest VM - for example, through a phishing compromise of a tenant workload - crafts a malicious hypercall or device emulation request that triggers the heap overflow in the host-side Hyper-V component. The overflow corrupts host heap structures, allowing the attacker to redirect execution flow to shellcode running at the hypervisor privilege level. From there, the attacker gains full control of the physical host, can read or modify memory of all other co-hosted VMs, and can establish persistence below the guest OS boundary. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests this would not be unusually difficult to develop for a motivated, capable threat actor.