OTPulse

Windows Hyper-V Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-105733Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

Improper access control in Windows Hyper-V allows an authorized local attacker with user privileges to execute code at a higher privilege level. This affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across x64, ARM64, and 32-bit architectures. Vendor has released patches for all affected versions.

What this means
What could happen
An attacker with local access and user-level privileges could run commands as a higher privilege level on your Hyper-V host, potentially affecting all virtual machines running on that host or the host's operations.
Who's at risk
Water utilities and municipal electric systems using Windows-based virtualization infrastructure should prioritize patching. This affects IT teams managing Hyper-V hosts that support SCADA systems, HMIs, engineering workstations, or other critical control systems running in virtual machines.
How it could be exploited
An attacker with local user access to a Windows system running Hyper-V leverages improper access controls to escalate privileges and execute arbitrary code on the hypervisor, gaining control over the virtualized environment.
Prerequisites
  • Local access to a Windows system with Hyper-V role enabled
  • User-level privileges (PR:L in CVSS vector)
  • Hyper-V role must be installed and active on the target system
Local access required to exploitUser-level credentials neededLow complexity exploitationAffects virtualization of critical systemsPrivilege escalation vulnerability
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (20)
20 with fix
ProductAffected VersionsFix Status
Windows 10 Version 21H2 for ARM64-based SystemsAll versionsBuild 10.0.19044.7807
Windows 10 Version 22H2 for ARM64-based SystemsAll versionsBuild 10.0.19044.7807
Windows 10 Version 21H2 for x64-based SystemsAll versionsBuild 10.0.19044.7807
Windows 10 Version 22H2 for x64-based SystemsAll versionsBuild 10.0.19044.7807
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/3
Do now
0/1
HARDENINGRestrict local access to Hyper-V hosts to trusted administrative users only
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the October 2026 Windows security update to all Hyper-V hosts
Long-term hardening
0/1
HARDENINGDisable Hyper-V role on systems where it is not required
View full vendor advisory
API: /api/v1/advisories/6c2f6801-2cb8-4b87-aa40-ab8c3f799fb3

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.