Windows Hyper-V Elevation of Privilege Vulnerability
Plan PatchCVSS 8.2CVE-2026-72961Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredHigh
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds read vulnerability in Windows Hyper-V allows an authorized user to elevate their privileges on the local system. The vulnerability affects all supported versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. Microsoft has released patches for all affected versions in the September 2026 security update.
What this means
What could happen
An authorized user on a Windows system running Hyper-V could exploit an out-of-bounds memory read to gain higher privileges on that system. This could allow them to bypass access controls and run commands they are not normally permitted to execute.
Who's at risk
Windows administrators and IT staff managing systems with Hyper-V virtualization. This affects Windows 10 (all versions 1607–22H2), Windows 11 (all versions 23H2–26H1), Windows Server 2016, 2019, 2022, and 2025. Any organization using Hyper-V for virtual machine hosting, including small data centers, branch offices, or remote infrastructure, should prioritize patching.
How it could be exploited
An attacker with a user account on a Windows system running Hyper-V could craft a malicious request that triggers an out-of-bounds read in the Hyper-V component. By exploiting this memory read, they could extract sensitive data or elevate their privilege level to administrator or system level, then use those elevated privileges to modify system configuration, access restricted files, or interfere with virtualized machines.
Prerequisites
- Valid user account on the target Windows system
- Hyper-V service running and accessible to the user account
- Local or network access to the system (depending on account type)
High CVSS score (8.2)Local attacker with administrative or user privileges requiredLow complexity exploitAffects virtualization platform (potential for lateral movement across VMs)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/2
Do now
0/1HARDENINGRestrict local administrative access and user accounts to trusted individuals; audit user account privileges regularly to minimize who can access Hyper-V
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the September 2026 Windows security update for your specific Windows version and architecture (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025)
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/694206c4-fad2-4d4f-9172-2f7f3e0af4b0Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.