Windows Hyper-V Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-70023Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows Hyper-V allows an authorized local attacker to elevate privileges to SYSTEM level. The vulnerability exists in multiple Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), Windows Server 2019, 2022, and 2025.
What this means
What could happen
An authorized user on a Windows system running Hyper-V could run commands with elevated privileges, potentially allowing them to modify virtual machine configurations, access sensitive data, or compromise the host system's security controls.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025 with Hyper-V enabled. This includes IT staff managing virtualization infrastructure, virtual desktop environments, and any systems using Hyper-V for containerization or virtual machine hosting.
How it could be exploited
An attacker with a local user account on a Windows system with Hyper-V enabled exploits a use-after-free flaw in the Hyper-V subsystem to execute code with SYSTEM privileges, bypassing normal privilege restrictions.
Prerequisites
- Local user account on the affected Windows system
- Hyper-V role or feature enabled on the target system
- Ability to run applications as the local user
Low complexity exploitationNo authentication required beyond local user accountAffects virtualization infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (24)
24 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 security update (or later) for your Windows version to patch CVE-2026-70023
Long-term hardening
0/2HARDENINGRestrict local administrative access to systems with Hyper-V enabled; audit and remove unnecessary user accounts
HARDENINGIf Hyper-V is not required on a system, disable the Hyper-V role or feature to eliminate the attack surface
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/fa998f25-36f9-4af3-aef9-607793191580Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.