Windows Hyper-V Elevation of Privilege Vulnerability
Plan PatchCVSS 7.8CVE-2026-96223Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows Hyper-V allows an authorized user with local access to elevate privileges on Windows 11 (all recent versions) and Windows Server 2025. Successful exploitation grants system-level access on the affected host, potentially compromising all guest virtual machines running on that host. Exploitation is assessed as less likely without specific knowledge of the vulnerability details.
What this means
What could happen
An authorized user with local access to a Windows system running Hyper-V could exploit a use-after-free vulnerability to gain elevated privileges on that system. This could allow them to run commands with system-level permissions, potentially affecting any applications or services running on that host.
Who's at risk
Organizations using Windows 11 (versions 24H2, 25H2, or 26H2) or Windows Server 2025 as Hyper-V hosts should prioritize this update. This is most critical for water utilities and electric utilities that run virtualized OT systems on these platforms, or for data centers hosting OT-related virtual machines. Virtualized PLCs, HMIs, or network devices running on affected Hyper-V hosts could be compromised if a malicious insider or contractor gains user-level access.
How it could be exploited
An attacker with a regular user account on a Windows 11 or Windows Server 2025 system must first gain local login access. Once authenticated, they can trigger the use-after-free condition in Hyper-V to escalate their privileges to system-level access. The attack requires no user interaction and works on the local system only.
Prerequisites
- Valid user account credentials on the local Windows system
- Local login access (physical or remote desktop)
- Windows 11 or Windows Server 2025 running Hyper-V with an unpatched version
low complexityrequires valid user credentialslocal access onlyaffects host operating system and all guest VMsno authentication bypass
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (10)
10 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict local user account access to systems running Hyper-V to only trusted administrators
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2025
HOTFIXApply the October 2026 security update to Windows 11 or Windows Server 2025 to bring systems to the fixed build numbers
Long-term hardening
0/1HARDENINGDisable remote desktop (RDP) on Hyper-V hosts unless required for operations, and if enabled, restrict access via firewall rules to administrative networks only
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/d2ed8227-7a37-4f79-8c05-08e1b7b5ecefGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.