Executive brief
Microsoft Hyper-V is a virtualization platform used to run multiple isolated virtual machines on Windows servers and client systems. A missing authorization check allows an already-authenticated attacker to escalate their privileges and potentially gain control over virtualized systems or the host machine itself via network access.
Technical details
This vulnerability involves a missing authorization check in Windows Hyper-V that fails to properly validate permissions for certain operations. An authenticated attacker with network access to a Hyper-V system can exploit this flaw to escalate privileges beyond their intended authorization level. The vulnerability requires the attacker to already have valid credentials, but does not require any additional user interaction. Successful exploitation could allow an attacker to gain elevated control over virtual machines or the host system. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows Hyper-V <UNKNOWN>
Timeline
- 2026-09-08: disclosed