Windows Hyper-V CVE-2026-83728

Requires the Hyper-V role/feature to be enabled and the attacker to already hold a valid low-privileged local account (PR:L) on the affected Windows host; exploitation is local only (AV:L) with no user interaction (UI:N) and low complexity (AC:L). Limiting factors that reduce real-world risk: there is no remote or unauthenticated path, Hyper-V is not enabled by default on all Windows SKUs, and CISA SSVC rates the flaw as non-automatable with no observed exploitation - so a successful attack presupposes an already-authenticated foothold on a virtualization host.

CVSS 8.8 (HIGH) is inflated by the scope change (S:C) and full C:H/I:H/A:H impact, but the attack vector is strictly local (AV:L) and requires a valid low-privileged account (PR:L), so this is not a remote or pre-auth threat. CISA's SSVC framework reinforces a lower real-world urgency: Exploitation=none (no observed activity), Automatable=no (cannot be mass-scripted), though Technical Impact=total. No EPSS score was provided, and there is no KEV listing or public POC, so there is no evidence of active or imminent exploitation - this reads as a serious-but-latent local privilege/boundary issue rather than an internet-facing emergency. Two data conflicts must be flagged: (1) the description characterizes the flaw as 'spoofing,' yet the CVSS vector claims full confidentiality, integrity, AND availability loss with a scope change, which is atypical for a pure spoofing weakness - verify the true impact with Microsoft's MSRC advisory; (2) the input Tags label this 'Information Disclosure,' which contradicts the vendor's 'spoofing' description. Priority is moderate: patch on a normal cycle, prioritizing multi-tenant Hyper-V hosts where a guest-to-host boundary crossing (implied by S:C) would matter most.

A low-privileged but authenticated user with local access to a Hyper-V-enabled system submits syntactically malformed input that the hypervisor fails to validate properly, allowing them to spoof identity or data across a security boundary (the scope change suggests a guest-to-host or cross-component impact). No public exploit code has been identified, and exploitation requires existing local credentials rather than remote access.