OTPulse

Windows Hyper-V Security Feature Bypass Vulnerability

MonitorCVSS 4.2CVE-2026-83766Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorAdjacent
Auth RequiredHigh
ComplexityHigh
User InteractionNone needed
Summary

Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security feature over an adjacent network. An attacker with valid credentials and access to the local network segment could circumvent authorization controls on Hyper-V virtual machine operations.

What this means
What could happen
An authorized user on an adjacent network could bypass Hyper-V security restrictions, potentially allowing unauthorized access or configuration changes to virtual machines. This is primarily a security feature bypass, not direct operational disruption.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 with Hyper-V enabled should apply updates. This primarily affects virtualization hosts used in data centers or for laboratory environments that may support OT workloads or IoT device testing.
How it could be exploited
An attacker with valid credentials and network access to a Windows system running Hyper-V (on the same local network segment) could send specially crafted requests to bypass authorization checks. This could allow them to perform operations on virtual machines that should be restricted by security policy.
Prerequisites
  • Valid user credentials on the Windows system
  • Network access from an adjacent (same subnet or local network) device
  • Hyper-V role enabled on the target Windows system
Requires valid credentialsRequires adjacent network accessLow complexity exploitSecurity feature bypass rather than direct code execution
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (27)
27 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/3
Do now
0/1
HARDENINGRestrict network access to Hyper-V management ports and services to authorized administrative networks only
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the October 2026 Windows security updates to all affected Windows and Windows Server systems
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate Hyper-V hosts on a separate management network from general user access
View full vendor advisory
API: /api/v1/advisories/1412689a-1061-4d3f-8a62-c9c25749c94a

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.