Windows Hyper-V CVE-2026-87705

Requires the Hyper-V role to be enabled on an affected Windows or Windows Server host, and the attacker must already have a position on the adjacent network (AV:A) - typically a guest VM or a host on the same layer-2/virtual-switch segment, not a remote internet attacker. No authentication is required (PR:N) and no user interaction is needed (UI:N), and default configurations of Hyper-V-enabled hosts appear affected. The primary limiting factor is the adjacency requirement: an attacker must first reach the relevant virtual/physical network segment, which confines realistic exploitation to environments where the attacker has already breached the virtualization network or controls a co-resident guest.

This is a moderate-priority, not a drop-everything, issue. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 7.4) indicates an unauthenticated attacker on an adjacent network with low complexity can achieve a scope-changing confidentiality impact. However, all exploitation-likelihood signals point downward: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial' - which is consistent with a security-feature-bypass rather than full host compromise. There is no KEV listing and no public POC, so the correct exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was supplied, so quantitative exploitation probability cannot be stated. CONFLICT TO VERIFY: the description characterizes this purely as a 'security feature bypass' (reinforced by CWE-940, Improper Verification of Source of a Communication Channel, and the 'Authentication Bypass' tag), yet the CVSS vector claims C:H with a changed scope and I:N/A:N - a bypass that yields high confidentiality but no integrity/availability impact is plausible but unusual, so confirm the actual impact with Microsoft's advisory. The AV:A requirement (attacker must already have a foothold on the adjacent/VM network segment, not the open internet) materially limits real-world exposure.

An attacker with a presence on the same adjacent network segment as a Hyper-V host (for example, a compromised guest VM or a device on the virtual switch's L2 segment) sends traffic that the host fails to properly validate the source of, causing it to accept communication it should have rejected and thereby bypassing a host security feature to disclose protected information. No public exploit code is known, and SSVC rates the attack as non-automatable, so any attack would be manual and targeted. Exploitation requires no authentication (PR:N) and no user interaction (UI:N).