OTPulse

Windows Hyper-V Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-83716Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A heap-based buffer overflow in Windows Hyper-V allows an authorized local user to execute arbitrary code in the context of the Hyper-V service. The vulnerability exists in all supported versions of Windows 10, Windows 11, and Windows Server editions with Hyper-V. An attacker with local system access could trigger this flaw to gain code execution with Hyper-V service privileges, potentially compromising virtual machines or the host system.

What this means
What could happen
A user with local access to a Windows system running Hyper-V could exploit a memory flaw to run code with the same privileges as the Hyper-V service, potentially disrupting virtual machines or gaining elevated control on the host system.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 with Hyper-V enabled should prioritize patching. This includes data center environments using Hyper-V for virtualization, and any Windows systems where Hyper-V role is installed for testing or production workloads.
How it could be exploited
An attacker with a local user account on a Windows system running Hyper-V could trigger a heap buffer overflow in the Hyper-V component through local API calls or Hyper-V management interfaces, executing arbitrary code in the context of the Hyper-V service.
Prerequisites
  • Local user account access on the Windows system
  • Hyper-V role or feature enabled on the system
  • Ability to interact with Hyper-V management APIs or kernel interfaces
Requires local user privilegesLow exploitation complexityHyper-V required (not installed by default on client systems)Affects virtualization infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/2
Do now
0/1
HARDENINGRestrict local console and RDP access to authorized users only
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the October 2026 Windows security update to patch the Hyper-V vulnerability
View full vendor advisory
API: /api/v1/advisories/90cbb0bc-fb23-40e2-aea6-ddd6ac02f3ae

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows Hyper-V Remote Code Execution Vulnerability | CVSS 8.8 - OTPulse