Windows Hyper-V EUVD-2026-73017

Exploitation requires the target Windows host to have the Hyper-V role/feature installed and active - not a default configuration on most Windows 10/11 clients, applying mainly to virtualization hosts (Windows Server 2019/2022/2025 and enabled client SKUs). The attacker must already hold low-level authenticated access (PR:L) and reach a Hyper-V network-facing interface (AV:N). The primary limiting factor is high attack complexity (AC:H): success depends on conditions outside the attacker's control (likely a race or specific state), which is why CISA marks the flaw Automatable=no and EPSS remains at 0.50%. No user interaction is needed (UI:N). Non-Hyper-V systems are effectively unaffected; virtualization hosts should be patched to the fixed builds (e.g. Server 2025 >=10.0.26100.33438, Server 2022 >=10.0.20348.5622, Server 2019 >=10.0.17763.9245, Windows 11 24H2/25H2 >=10.0.26100.9445/10.0.26200.9445).

Microsoft's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5 HIGH) describes a network-reachable elevation-of-privilege in Windows Hyper-V requiring low privileges and no user interaction, but rated high attack complexity - indicating a race, specific timing, or non-trivial preconditions rather than a trivially repeatable exploit. Every other real-world exploitation signal is low: EPSS is 0.50% (41st percentile), there is no CISA KEV listing, and no public PoC is identified. CISA SSVC reinforces this: Exploitation=none (no observed exploitation) and Automatable=no (AC:H is inconsistent with reliable mass-scanning), though Technical Impact=total aligns with the C:H/I:H/A:H claim of full compromise of the affected scope once exploited. The signals are internally consistent - a genuinely high technical impact gated behind meaningful complexity - so this is a patch-in-normal-cycle item rather than an emergency: prioritize on hosts actually running the Hyper-V role and deprioritize elsewhere. One caution: the terse description ('missing authorization ... elevate privileges over a network') gives no detail on whether S:U is correct for a hypervisor scenario; a missing-authorization Hyper-V EoP could plausibly cross a trust boundary, so treat the scope/impact breakdown as vendor-asserted and not independently verifiable from the provided data.

An attacker with a low-privilege authenticated foothold (e.g. a standard account or a guest VM context) sends crafted requests over the network to a Windows host running the Hyper-V role, exploiting a missing authorization check (CWE-862) to perform an operation reserved for higher-privileged principals. Winning the required conditions (AC:H) yields full elevation with total confidentiality, integrity, and availability impact on the affected scope. No public exploit code is identified at time of analysis, and CISA SSVC records no observed exploitation.