Windows Hyper-V EUVD-2026-99476

Exploitation requires the attacker to already have authenticated local, low-privileged access to a system running the Windows Hyper-V role (PR:L, AV:L) and the ability to create or control filesystem links (symbolic/hard/junction) that a privileged Hyper-V file operation will resolve ('link following,' CWE-59). The decisive condition is winning this link-resolution race or planting a link in a location a Hyper-V privileged process accesses. Limiting factors that reduce real-world risk: no network vector (local access mandatory), a pre-existing foothold with some privileges is required, the Hyper-V role must be installed/enabled (not present on default non-virtualization Windows installs), and SSVC rates it non-automatable, implying it is not readily scriptable at scale.

This is a locally-exploitable privilege-escalation flaw (CVSS 3.1 AV:L/AC:L/PR:L/UI:N, score 7.8) in the Windows Hyper-V link-resolution logic (CWE-59). The signals are internally consistent and point to moderate, not emergency, priority: the CVSS vector requires local access and existing low privileges (PR:L), CISA's SSVC decision framework records Exploitation=none and Automatable=no, and there is no CISA KEV listing and no public exploit identified. The one signal pulling upward is SSVC Technical Impact=total, which aligns with the full C:H/I:H/A:H impact - successful exploitation yields complete control of the host. No EPSS score was provided, so statistical exploitation probability cannot be weighed. Net: a genuine high-severity local EoP that matters most on multi-tenant Hyper-V hosts (where a low-privileged guest/user escaping to SYSTEM is a serious boundary breach), but the local vector, required prior foothold, and non-automatable nature make it a patch-on-cycle item rather than a drop-everything exploited-in-the-wild emergency. Note a metadata discrepancy: the input Tags include 'Information Disclosure,' which conflicts with the description's elevation-of-privilege characterization - treat the EoP framing (per the description and C/I/A=H impact) as authoritative.

A low-privileged local attacker already present on a Hyper-V host (e.g., a standard user or a limited service account) plants or manipulates a symbolic/hard link so that a privileged Hyper-V operation resolves to an attacker-chosen target file during access. By winning this link-following condition, the attacker causes the privileged process to act on a file it should not, escalating to SYSTEM-level control of the host. No public proof-of-concept or active exploitation has been identified at time of analysis.