Windows Server 2016 EUVD-2026-22534

Authorized local user account on Windows system with Hyper-V installed and user interaction required to open or interact with Hyper-V management interface or features.

The CVSS v3.1 score of 7.3 (High) reflects a local attack vector (AV:L) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R), producing high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) with unchanged scope (S:U). While the high CVSS score appears alarming, real-world risk is moderated by several constraints: attackers must already possess authenticated local access with low-level privileges, and successful exploitation requires user interaction, creating operational friction. The local-only attack vector significantly limits remote threat actor capabilities compared to network-exploitable vulnerabilities. No public exploit identified at time of analysis and absence from CISA KEV indicates this is not being actively exploited in the wild. However, the widespread deployment of Hyper-V in enterprise virtualization infrastructure, combined with low attack complexity once access prerequisites are met, makes this a priority for organizations using Hyper-V in multi-tenant or privilege-separated environments where insider threats or compromised accounts pose risks. The requirement for user interaction suggests potential social engineering attack chains rather than fully automated exploitation.

An authenticated local user crafts specially formatted input through the Hyper-V management interface. With user interaction, the malicious input bypasses validation, executing arbitrary code with hypervisor privileges on the Windows host.