Hyper-V
Monthly
Hyper-V on affected Windows and Windows Server hosts fails to properly verify the source of a communication channel, letting an unauthenticated attacker on an adjacent network bypass a Hyper-V security feature. The assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates high confidentiality impact that crosses a security scope boundary, but with no integrity or availability impact; the practical prerequisite is that the attacker already occupies a position on the adjacent layer-2 / virtual-switch segment, such as a co-resident guest VM or a host on the same segment, rather than reaching the target from the internet. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no' (the adjacency requirement prevents trivial mass exploitation), and vendor patches are available. This is a moderate-priority hardening issue rather than an emergency, but it is worth treating seriously in multi-tenant or high-density virtualization environments where untrusted guests may share a virtual switch with sensitive workloads.
Elevation of privilege in Microsoft Hyper-V lets an attacker who already holds high privileges inside a guest virtual machine trigger an out-of-bounds read that crosses the hypervisor boundary, yielding full confidentiality, integrity, and availability impact on the host (scope change, C:H/I:H/A:H). The flaw (CWE-125) is local, requires no user interaction, and is only reachable on Windows systems where the Hyper-V role is installed and enabled, making it a post-compromise guest-to-host escape rather than a remote or unprivileged attack. No public exploit code has been identified and CISA's SSVC assessment rates exploitation as none; vendor patches addressing the affected builds are available, so this is a serious but not emergency-grade issue for unpatched Hyper-V hosts.
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who already holds low-privileged access inside a guest VM corrupt hypervisor heap memory and execute code on the Windows host, crossing the virtualization boundary (Scope: Changed). Exploitation requires the Hyper-V role to be enabled and a guest foothold (AV:L/PR:L), with no user interaction and low attack complexity, but there is no remote or network-facing attack surface, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patched builds for the affected Windows 10, Windows 11 and Windows Server 2016 through 2025 versions, making this a credible high-priority patch target rather than an emergency.
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.
Windows Hyper-V fails to properly enforce access controls, enabling local authenticated users to circumvent security features and gain unauthorized system access. This high-severity flaw affects Windows 10, Windows 11, Windows Server 2022, and Hyper-V implementations, allowing privileged attackers to escalate privileges across system boundaries. No patch is currently available for this vulnerability.
Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privileges on affected Windows and Windows Server systems. An attacker with local access and user-level permissions can trigger memory corruption through user interaction to compromise system integrity and confidentiality. This vulnerability affects Windows 10 1809, Windows Server 2025, and related Hyper-V implementations with no patch currently available.
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. [CVSS 7.3 HIGH]
Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privileges (CVSS 7.3). Exploitation requires user interaction and local system access, affecting Windows 10 1809 and Windows Server 2025. No patch is currently available.
Incorrect authorization in Windows Hyper-V (CWE-863) on multiple Windows 10, Windows 11, and Windows Server versions could let an attacker who already holds high privileges on a guest or host bypass a Hyper-V security feature when positioned on the same adjacent network, but the attacker cannot read data or cause availability loss in the assessed vector. No public exploit code was identified at time of analysis, and all available signals - including the SSVC exploitation decision of 'none' and the high attack complexity - indicate low real-world risk despite Hyper-V’s security-sensitive role.
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low privileges to disclose information across the guest-to-host boundary on affected Windows builds. Exploitation requires the Hyper-V role to be enabled and the attacker to already have a foothold with low-privileged code execution in a Hyper-V guest on an unpatched host, so exposure is limited to virtualized environments rather than remote or non-Hyper-V systems; impact is confined to confidentiality loss with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and a non-automatable attack path, indicating limited real-world urgency; a vendor patch is available, and the CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Hyper-V on affected Windows and Windows Server hosts fails to properly verify the source of a communication channel, letting an unauthenticated attacker on an adjacent network bypass a Hyper-V security feature. The assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates high confidentiality impact that crosses a security scope boundary, but with no integrity or availability impact; the practical prerequisite is that the attacker already occupies a position on the adjacent layer-2 / virtual-switch segment, such as a co-resident guest VM or a host on the same segment, rather than reaching the target from the internet. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as 'none' and automatable as 'no' (the adjacency requirement prevents trivial mass exploitation), and vendor patches are available. This is a moderate-priority hardening issue rather than an emergency, but it is worth treating seriously in multi-tenant or high-density virtualization environments where untrusted guests may share a virtual switch with sensitive workloads.
Elevation of privilege in Microsoft Hyper-V lets an attacker who already holds high privileges inside a guest virtual machine trigger an out-of-bounds read that crosses the hypervisor boundary, yielding full confidentiality, integrity, and availability impact on the host (scope change, C:H/I:H/A:H). The flaw (CWE-125) is local, requires no user interaction, and is only reachable on Windows systems where the Hyper-V role is installed and enabled, making it a post-compromise guest-to-host escape rather than a remote or unprivileged attack. No public exploit code has been identified and CISA's SSVC assessment rates exploitation as none; vendor patches addressing the affected builds are available, so this is a serious but not emergency-grade issue for unpatched Hyper-V hosts.
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who already holds low-privileged access inside a guest VM corrupt hypervisor heap memory and execute code on the Windows host, crossing the virtualization boundary (Scope: Changed). Exploitation requires the Hyper-V role to be enabled and a guest foothold (AV:L/PR:L), with no user interaction and low attack complexity, but there is no remote or network-facing attack surface, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Microsoft has released patched builds for the affected Windows 10, Windows 11 and Windows Server 2016 through 2025 versions, making this a credible high-priority patch target rather than an emergency.
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.
Windows Hyper-V fails to properly enforce access controls, enabling local authenticated users to circumvent security features and gain unauthorized system access. This high-severity flaw affects Windows 10, Windows 11, Windows Server 2022, and Hyper-V implementations, allowing privileged attackers to escalate privileges across system boundaries. No patch is currently available for this vulnerability.
Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privileges on affected Windows and Windows Server systems. An attacker with local access and user-level permissions can trigger memory corruption through user interaction to compromise system integrity and confidentiality. This vulnerability affects Windows 10 1809, Windows Server 2025, and related Hyper-V implementations with no patch currently available.
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. [CVSS 7.3 HIGH]
Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privileges (CVSS 7.3). Exploitation requires user interaction and local system access, affecting Windows 10 1809 and Windows Server 2025. No patch is currently available.
Incorrect authorization in Windows Hyper-V (CWE-863) on multiple Windows 10, Windows 11, and Windows Server versions could let an attacker who already holds high privileges on a guest or host bypass a Hyper-V security feature when positioned on the same adjacent network, but the attacker cannot read data or cause availability loss in the assessed vector. No public exploit code was identified at time of analysis, and all available signals - including the SSVC exploitation decision of 'none' and the high attack complexity - indicate low real-world risk despite Hyper-V’s security-sensitive role.
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low privileges to disclose information across the guest-to-host boundary on affected Windows builds. Exploitation requires the Hyper-V role to be enabled and the attacker to already have a foothold with low-privileged code execution in a Hyper-V guest on an unpatched host, so exposure is limited to virtualized environments rather than remote or non-Hyper-V systems; impact is confined to confidentiality loss with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation and a non-automatable attack path, indicating limited real-world urgency; a vendor patch is available, and the CVSS 3.1 base score is 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).