OTPulse

Windows Hyper-V Denial of Service Vulnerability

MonitorCVSS 6.5CVE-2026-83636Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A null pointer dereference vulnerability in Windows Hyper-V allows an authorized local attacker to cause a denial of service by crashing the hypervisor. An attacker with local system access can trigger this flaw to crash Hyper-V, making all virtual machines on that host unavailable until the system recovers. All versions of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 are affected.

What this means
What could happen
A user with local system access could crash Hyper-V, stopping all virtual machines running on that host until it recovers. This affects any organization using Hyper-V for server consolidation or lab environments.
Who's at risk
Organizations using Windows Server 2022 or 2025 for Hyper-V virtualization, and any IT teams running Windows 10 or 11 systems with Hyper-V enabled for testing or lab purposes. Impacts availability of all virtual machines hosted on affected systems.
How it could be exploited
An attacker with local user or administrative access to a Windows system running Hyper-V can trigger a null pointer dereference in the Hyper-V hypervisor, causing it to crash and rendering all virtual machines on that host unavailable.
Prerequisites
  • Local access to the Windows system (local user account or higher)
  • Hyper-V role enabled on the target Windows or Windows Server system
  • Ability to execute code or issue Hyper-V API calls from a local session
Low attack complexityRequires local access (insider threat or compromised local account)Affects availability of virtualized systems
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (20)
20 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows Server 2022All versionsBuild 10.0.20348.5761
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5761
Windows 10 Version 21H2 for 32-bit SystemsAll versionsBuild 10.0.19044.7807
Remediation & Mitigation
0/8
Do now
0/1
HARDENINGRestrict local access to Hyper-V hosts to authorized administrative personnel only
Schedule — requires maintenance window
0/6

Patching may require device reboot — plan for process interruption

Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 11 Version 26H2 (x64) to Build 10.0.26300.9711 or later
HOTFIXUpdate Windows 11 Version 26H2 (ARM64) to Build 10.0.26300.9711 or later
HOTFIXUpdate Windows 10 Version 21H2 (all architectures) to Build 10.0.19044.7807 or later
HOTFIXUpdate Windows 10 Version 22H2 to Build 10.0.19045.7807 or later
Long-term hardening
0/1
HARDENINGSegregate Hyper-V management traffic to a dedicated, restricted management network
View full vendor advisory
API: /api/v1/advisories/43021235-b5ab-4673-aaf2-8307314be0a9

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows Hyper-V Denial of Service Vulnerability | CVSS 6.5 - OTPulse