Windows Hyper-V CVE-2026-70023

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on a Windows system that has the Hyper-V role/feature enabled (PR:L, AV:L, UI:N). Limiting factors: there is no remote or unauthenticated path - the attacker needs an existing foothold on the host; the vulnerable Hyper-V component must be present and active (non-default on most client/desktop installs, common on servers and virtualization hosts); and successful exploitation of a use-after-free typically depends on winning a memory-state race, which the SSVC 'Automatable: no' rating reflects. Risk is concentrated on multi-tenant or shared Hyper-V hosts where untrusted low-privilege principals run.

This is a locally-exploitable, authenticated privilege-escalation flaw (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U with full C:H/I:H/A:H impact). The signals are internally consistent but point to a moderate real-world priority rather than an urgent emergency: the CVSS confirms local attack vector and low (but non-zero) privilege requirement, meaning an attacker must already have authenticated code-execution footing on the host. CISA's SSVC framework reinforces this - Exploitation is rated 'none' (no observed or public exploitation) and Automatable 'no' (not mass-scannable/wormable), though Technical Impact is 'total' once triggered. The CVE is NOT in CISA KEV and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, which is a data gap for probabilistic triage. There are no conflicting signals: a local-only UAF with 'none' exploitation and 'no' automatable status is a classic patch-in-normal-cycle item, prioritized higher on multi-tenant Hyper-V hosts where untrusted low-privilege workloads run. Note the 'Denial Of Service' tag is somewhat at odds with the description's elevation-of-privilege framing; the A:H metric is consistent with a UAF that can also crash the component.

A low-privileged but authenticated attacker already executing code on a Windows host with the Hyper-V role enabled triggers the use-after-free in the Hyper-V component to corrupt memory and gain SYSTEM-level privileges on the host. Because the CVSS vector is local (AV:L) with no user interaction, this is a post-compromise escalation step rather than an initial-access vector. No public exploit code is referenced, so an attacker would need to develop a reliable UAF exploit independently.