Windows Hyper-V EUVD-2026-99987

Exploitation requires the Windows Hyper-V role to be enabled on the target host, the attacker to already possess high privileges (PR:H) on a system, and adjacent-network positioning (AV:A) such as the same L2 segment or virtual switch as the host - it is not exploitable over the open internet. High attack complexity (AC:H) further limits exploitation, implying a required race condition or specific preconditions outside the attacker's direct control. No user interaction is needed (UI:N). The combination of required high privileges, adjacency, and high complexity makes realistic exploitation substantially harder than the integrity impact alone would suggest.

All signals converge on LOW real-world risk despite the vulnerability affecting a security-sensitive component (Hyper-V). The CVSS 3.1 base score is only 4.2, and the vector explains why: AV:A requires adjacent-network positioning (not internet-routable), AC:H indicates a hard-to-win race or specific preconditions, and PR:H means the attacker must already hold high privileges on the system. Impact is narrow - I:H only, with C:N and A:N, so this is an integrity/security-feature-bypass issue, not an RCE or data-disclosure flaw. The CISA SSVC framework reinforces this: Exploitation=none (no observed activity), Automatable=no (cannot be reliably scripted at scale), Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input (its absence is not itself a risk signal). No signals conflict here - the low CVSS, benign SSVC, and absence of exploitation evidence all agree. This is a defense-in-depth patch to deploy on a normal cycle, not an emergency. Note that the input 'Authentication Bypass' tag is slightly imprecise: CWE-863 and the description describe an authorization/security-feature bypass, not an authentication bypass.

An attacker who already holds high privileges on a machine sharing an adjacent network segment (e.g., the same virtual switch or L2 broadcast domain) with a Hyper-V host exploits an incorrect-authorization flaw to bypass a protective security feature and tamper with protected state. The high attack complexity (AC:H) means success depends on winning a timing window or meeting specific preconditions. No public proof-of-concept exploit has been identified at time of analysis.