Windows Hyper-V Remote Code Execution Vulnerability
Plan PatchCVSS 8.8CVE-2026-69603Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A heap-based buffer overflow vulnerability exists in Windows Hyper-V that allows an authorized attacker with local user or administrator credentials to execute arbitrary code on the host system. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. Microsoft has released patches for all affected versions.
What this means
What could happen
An attacker with local administrator or user credentials could run arbitrary code on a Windows server running Hyper-V, potentially allowing them to break out of virtual machines or gain control of the host system.
Who's at risk
Windows server and desktop administrators running Hyper-V virtualization, particularly those managing Server 2016, 2019, 2022, or 2025 environments, or Windows 10/11 systems with Hyper-V enabled for testing or development.
How it could be exploited
An attacker with valid login credentials on the Windows host runs malicious code that triggers a heap buffer overflow in the Hyper-V driver. This overflow allows arbitrary code execution with the privileges of the attacker's logged-in session, potentially enabling escape from guest VMs or lateral movement on the host.
Prerequisites
- Valid local user account credentials on the Windows host
- Local code execution capability (ability to run executables as the logged-in user)
- Windows Hyper-V role must be enabled on the host
requires local accesslow complexity attackhigh CVSS score (8.8)affects virtualization infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/2
Do now
0/1WORKAROUNDIf immediate patching is not possible, restrict local administrative access on Hyper-V hosts to only trusted personnel and disable unnecessary local user accounts
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft's September 2026 security update for your Windows version: Build 10.0.17763.9245 (Server 2019), Build 10.0.20348.5622 (Server 2022), Build 10.0.26100.33438 (Server 2025), or corresponding Windows 10/11 build for your version
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/96a2fc24-365d-419c-9cdf-29fce9786cc7Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.