Windows Hyper-V CVE-2026-80083

Exploitation requires an authorized (authenticated) user account within a running Hyper-V guest VM on an affected Windows Server 2022/2025 or Windows 11 (23H2-25H2) host. The Hyper-V role or feature must be enabled and one or more guest VMs must be running. Exploitation is entirely local to the guest: no network-reachable surface is required, and no interaction from another user or the host administrator is needed once the attacker has guest VM access. What limits exploitation: the attacker must already have local (or RDP/console) access to a guest VM; this is not a remote unauthenticated attack. Environments where untrusted users do not have VM guest access are not directly exposed.

The CVSS base score of 8.8 with S:C (scope change) accurately reflects the severity of a VM escape primitive: a low-privileged guest user with local access can achieve full Host C:H/I:H/A:H impact. EPSS data is not available in the provided intelligence, and CISA KEV status is absent, so exploitation probability cannot be quantified beyond the CVSS signal. No POC has been identified at time of analysis, which somewhat limits immediate weaponization risk. However, Hyper-V escapes are high-value targets in cloud and enterprise virtualization environments, and the AC:L rating means exploitation is not technically complex once a researcher understands the vulnerable code path. The combination of low complexity, no user interaction, and scope change makes this a priority patch for any environment running affected Windows versions with Hyper-V enabled. The 'Information Disclosure' tag is clearly mislabeled - the actual impact is arbitrary code execution with host-level privileges.

An attacker with a low-privilege user account inside a Hyper-V guest VM crafts a hypercall or VMBUS message that supplies a malicious pointer value into vulnerable Hyper-V host code. The hypervisor dereferences the attacker-controlled pointer, redirecting execution into attacker-supplied shellcode running at host privilege level, effectively escaping the VM boundary and gaining full control of the underlying Windows Server host and all other VMs it runs. No POC has been identified, but the AC:L rating suggests the technique would be reproducible once the vulnerable code path is identified through patch diffing.