Microsoft Hyper-V EUVD-2026-99080

Exploitation requires the attacker to already have low-privileged authenticated code-execution capability inside a Hyper-V guest virtual machine on an affected host - the vector is local (AV:L) with PR:L, so there is no remote or unauthenticated path. The Scope:Changed metric indicates the flaw lets code escape the guest and affect the host partition, meaning the primary at-risk deployments are hosts running untrusted, multi-tenant, or attacker-reachable guests. Limiting factors: the host must have the Hyper-V role enabled with at least one guest the attacker can run code in; no user interaction is needed (UI:N), but a guest foothold is a prerequisite, which constrains exploitation to environments where an attacker can already run code in a VM.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) describes a low-complexity, low-privilege local attack with a SCOPE CHANGE and full C/I/A impact - the signature pattern of a Hyper-V guest-to-host escape, where an authenticated low-privileged attacker inside a guest VM breaks out to compromise the hypervisor host. That scope change is what elevates an otherwise local, authenticated bug to 8.8. However, several real-world risk signals are MISSING from the input and must not be assumed: no EPSS score is provided, so exploitation probability cannot be quantified; there is no CISA KEV listing (no confirmed active exploitation); and no public POC is referenced. The only reference is the Microsoft MSRC advisory stub with no CVSS or CWE populated by NVD. Note also a data conflict: the input Tag labels this 'Information Disclosure,' but both the description ('execute code locally') and the vector (I:H/A:H) indicate code execution with integrity and availability impact - the tag appears mislabeled and should not drive triage. Net assessment: credible, patch-worthy virtualization-escape risk in a widely deployed product, but currently no evidence of in-the-wild exploitation, so it ranks below actively-exploited KEV items while remaining a priority for any host running untrusted or multi-tenant guests.

An attacker who already has the ability to run code inside a Hyper-V guest VM (e.g., a low-privileged user on a tenant VM or a compromised guest) abuses the improper access control to execute arbitrary code that crosses the virtualization boundary into the host partition. Because the CVSS scope is Changed, successful exploitation compromises the hypervisor host and, by extension, other guests on the same host. No public exploit code is identified at time of analysis, and the attack requires a pre-existing authenticated foothold on a guest rather than remote network access.