Windows Hyper-V Security Feature Bypass Vulnerability

Plan PatchCVSS 7.4CVE-2026-87705Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in Windows Hyper-V's source verification for communication channels allows an unauthorized attacker on an adjacent network to bypass security features. The attacker can exploit this to gain unauthorized access to virtual machines or hypervisor management functions without providing valid credentials. Exploitation is assessed as less likely, but the security feature bypass could expose sensitive operational data if a Hyper-V host is accessible from untrusted network segments.

What this means
What could happen
An attacker on the same local network segment could bypass Hyper-V security features to gain unauthorized access to virtual machines or the hypervisor host. This could allow an attacker to read sensitive data from virtualized systems without proper authentication.
Who's at risk
Water utilities and municipal electric systems using Windows Server for virtualized SCADA systems, historian databases, or engineering workstations with Hyper-V enabled should prioritize patching. This includes any organization running Hyper-V on Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems.
How it could be exploited
An attacker with access to the same network segment (adjacent network) could send specially crafted communications to the Hyper-V host that bypass the source verification checks in the communication channel. This allows the attacker to interact with Hyper-V features that should be restricted, potentially accessing VM data or management functions.
Prerequisites
  • Network access from adjacent network segment (same subnet or L2 broadcast domain)
  • Hyper-V role must be enabled on the Windows system
  • No authentication required to trigger the vulnerability
remotely exploitable from adjacent networkno authentication requiredlow complexityaffects virtualization securityhigh impact on confidentiality
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Microsoft's October 2026 security update or later to all Windows systems running Hyper-V
Long-term hardening
0/2
HARDENINGNetwork-segment Hyper-V hosts from untrusted networks using VLAN isolation or firewall rules to restrict access to the same network segment
HARDENINGIf virtualization is not required, disable Hyper-V role on Windows systems to eliminate the attack surface
API: /api/v1/advisories/c6664a85-b59c-4b0c-a5d7-9f3e20c5d6b9

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows Hyper-V Security Feature Bypass Vulnerability | CVSS 7.4 - OTPulse