OTPulse

Windows Hyper-V Elevation of Privilege Vulnerability

Plan PatchCVSS 7.2CVE-2026-108399Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredHigh
ComplexityHigh
User InteractionRequired
Summary

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally on affected Windows and Windows Server systems.

What this means
What could happen
An attacker with local access to a server running Hyper-V could gain administrative privileges, potentially compromising virtualized OT systems or the host infrastructure that manages critical operations.
Who's at risk
Windows and Windows Server administrators managing virtualized infrastructure should care about this vulnerability. It affects Windows 10 (all versions), Windows 11 (all versions), Windows Server 2016, 2019, 2022, and 2025. Organizations using Hyper-V to virtualize OT systems or running engineering workstations on these platforms are at risk of host compromise.
How it could be exploited
An attacker with local access and user credentials on a Hyper-V-enabled Windows or Windows Server system triggers a heap buffer overflow through Hyper-V interactions, escalating to administrative privileges and gaining control of the host or guest VMs.
Prerequisites
  • Local access to the target system
  • Valid user credentials
  • Hyper-V role enabled on the target system
  • Specific actions or interactions with Hyper-V components
Elevation of privilegeRequires authenticationModerate complexityLow exploit probability (0.3% EPSS)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/3
Do now
0/1
HARDENINGRestrict local access to Hyper-V-enabled systems to authorized personnel only
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply October 2026 security update to all affected Windows and Windows Server systems running Hyper-V
Long-term hardening
0/1
HARDENINGReview and enforce multi-factor authentication for accounts with local access to Hyper-V hosts
View full vendor advisory
API: /api/v1/advisories/d4ca3c40-f919-423a-8485-c7dbd36480fa

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.