OTPulse

Windows Hyper-V Denial of Service Vulnerability

MonitorCVSS 6.5CVE-2026-70248Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A null pointer dereference vulnerability in Windows Hyper-V allows an authorized local user to cause a denial of service by crashing the hypervisor. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Microsoft has released patches for all supported versions. Exploitation likelihood is assessed as less likely.

What this means
What could happen
An authorized user on a Windows system running Hyper-V could crash the hypervisor, causing all virtual machines on that host to stop running until the host is rebooted.
Who's at risk
Any utility or industrial facility running Windows-based Hyper-V hosts for virtualization of operational technology systems, engineering workstations, or SCADA servers. This includes water authorities and electric utilities using Hyper-V to consolidate control system workloads or run backup/failover instances of critical OT applications.
How it could be exploited
An attacker with a user account on a Windows machine running Hyper-V sends a malformed request to the Hyper-V service, triggering a null pointer dereference that crashes the hypervisor and stops all running VMs.
Prerequisites
  • Valid user account on the local Windows system
  • Windows Hyper-V role installed and enabled
  • Ability to send requests to the Hyper-V service via local APIs
Requires local user accountAffects availability of all VMs on the hostNo authentication bypassLow exploit complexityExploitation less likely per vendor assessment
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/8
Schedule — requires maintenance window
0/8

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 10 Version 1607 to Build 10.0.14393.9612 or later
HOTFIXUpdate Windows 10 Version 1809 to Build 10.0.17763.9376 or later
HOTFIXUpdate Windows 10 Versions 21H2 and later to the corresponding October 2026 build or newer
HOTFIXUpdate Windows 11 to the October 2026 security update matching your installed version
View full vendor advisory
API: /api/v1/advisories/72e00757-815b-4ac5-a123-452f9342ebfd

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.