OTPulse

Windows Hyper-V Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-80083Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An untrusted pointer dereference vulnerability in Windows Hyper-V allows an authorized local attacker to execute arbitrary code with system-level privileges on the Hyper-V host. The vulnerability affects Windows Server 2022, Windows Server 2025, and all recent versions of Windows 11 (23H2, 24H2, 25H2, and 26H1). Microsoft has released security updates for all affected versions. Exploitation is assessed as unlikely but possible. The vulnerability requires an attacker to already have a local user account on the Hyper-V host system.

What this means
What could happen
An attacker with local access to a Hyper-V host could run arbitrary code with system privileges, potentially disrupting virtual machines and any services they host.
Who's at risk
Organizations running Microsoft Hyper-V infrastructure, particularly those hosting critical services on virtual machines. Affected systems include Windows Server 2022, Windows Server 2025, and Windows 11 (all recent versions). Water utilities and power systems that rely on virtualized SCADA, HMI, or engineering workstations are at risk if those systems run on vulnerable Hyper-V hosts.
How it could be exploited
An attacker with a local user account on the Hyper-V host could exploit a pointer dereference flaw in the Hyper-V kernel driver to execute arbitrary code with elevated privileges on the host system.
Prerequisites
  • Local user account on the Hyper-V host system
  • Access to run code or commands on the host
Low authentication barrier (local user account required)Low complexity attackAffects virtualization platform affecting multiple servicesRequires local access to host
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows Server 2022All versionsBuild 10.0.20348.5622
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5622
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33438
Windows 11 Version 25H2 for ARM64-based SystemsAll versionsBuild 10.0.26200.9445
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9445
Windows 11 Version 23H2 for ARM64-based SystemsAll versionsBuild 10.0.22631.7582
Windows 11 Version 23H2 for x64-based SystemsAll versionsBuild 10.0.22631.7582
Windows 11 Version 24H2 for ARM64-based SystemsAll versionsBuild 10.0.26100.9445
Remediation & Mitigation
0/7
Schedule — requires maintenance window
0/6

Patching may require device reboot — plan for process interruption

Windows Server 2022
HOTFIXApply Windows Server 2022 security update Build 10.0.20348.5622 or later
Windows Server 2025
HOTFIXApply Windows Server 2025 security update Build 10.0.26100.33438 or later
All products
HOTFIXApply Windows 11 Version 23H2 security update Build 10.0.22631.7582 or later
HOTFIXApply Windows 11 Version 24H2 security update Build 10.0.26100.9445 or later
HOTFIXApply Windows 11 Version 25H2 security update Build 10.0.26200.9445 or later
HOTFIXApply Windows 11 Version 26H1 security update Build 10.0.28000.2954 or later
Long-term hardening
0/1
HARDENINGRestrict local administrator access to Hyper-V hosts to only authorized personnel
View full vendor advisory
API: /api/v1/advisories/47539ec3-5924-4e6e-b565-ca5e0908f76a

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.