# CVE-2026-83766: Microsoft Windows Hyper-V authorization bypass

Source: https://junglewise.ai/threats/cve-2026-83766-incorrect-authorization-in-windows-hyper-v-allows-an-authorized  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-83766 · Severity: medium · CVSS 4.2 · Published 2026-10-13

Windows Hyper-V, Microsoft's virtualization platform, contains an authorization flaw that allows a privileged attacker on an adjacent network to bypass security controls. An attacker exploiting this vulnerability could potentially access or manipulate virtualized systems that should be protected, though this requires the attacker to already have some level of authorization on the network.

Technologies: [Microsoft Windows Hyper-V](https://junglewise.ai/threats/technologies/windows-hyper-v). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-83766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83766 being exploited in the wild.

**How severe is CVE-2026-83766?** Medium severity, with a CVSS score of 4.2, published 13 October 2026.

**Which products and versions are affected?** Microsoft Windows Hyper-V.

**Is there a fix for CVE-2026-83766?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83766 attacked?** It is attacked from the adjacent network or over the network, in an operating system.

**Am I affected by CVE-2026-83766?** Check whether you run Microsoft Windows Hyper-V. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization logic flaw in Windows Hyper-V that permits an authenticated attacker positioned on an adjacent network segment to circumvent a security feature. The attack is possible over the adjacent network and requires the attacker to be authorized in some capacity. Successful exploitation allows the security control bypass but does not grant code execution or direct guest system access.

## Affected products

- Microsoft Windows Hyper-V

## Timeline

- 2026-10-13: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83766](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83766)

## Related threats

- [Microsoft Windows Hyper-V null pointer dereference DoS](https://junglewise.ai/threats/cve-2026-96965-null-pointer-dereference-in-windows-hyper-v-allows-an-authorized)
- [Microsoft Windows Hyper-V certificate validation bypass](https://junglewise.ai/threats/cve-2026-95910-improper-certificate-validation-in-windows-hyper-v-allows-an)
- [Microsoft Windows Hyper-V uninitialized resource privilege escalation](https://junglewise.ai/threats/cve-2026-119960-use-of-uninitialized-resource-in-windows-hyper-v-allows-an)
- [Windows Hyper-V access control spoofing vulnerability](https://junglewise.ai/threats/cve-2026-119959-improper-access-control-in-windows-hyper-v-allows-an-authorized)
- [Windows Hyper-V use-after-free privilege elevation](https://junglewise.ai/threats/cve-2026-119826-use-after-free-in-windows-hyper-v-allows-an-authorized-attacker)