CVE-2026-32149

What it actually does

CVE-2026-32149 is an improper input validation flaw in Microsoft Windows Hyper-V. An attacker who already has authorized local access can supply crafted input to a vulnerable Hyper-V component and cause unintended code execution on the local system. The CVSS vector indicates low attack complexity, low privileges required, and user interaction required, with potential high confidentiality, integrity, and availability impact if exploitation succeeds. In practical terms, this is most relevant on Windows client and server systems where Hyper-V is installed or enabled, including virtualization hosts and administrative workstations that manage Hyper-V workloads.

Why it matters to the business

Successful exploitation could let a local attacker gain powerful execution capability on a Windows system running Hyper-V, potentially leading to data theft, tampering with virtualized workloads, disruption of hosted services, or broader compromise if the affected system is a virtualization host. Although this vulnerability is not listed in CISA KEV, has no known mature public exploit in the provided data, and has a low/stable EPSS score, Hyper-V hosts often run sensitive workloads, so exposed systems should still be patched through normal high-priority Windows update processes.

How an attack unfolds

An attacker first needs a foothold on an affected Windows system or another authorized way to interact locally with vulnerable Hyper-V functionality. The attacker then delivers or invokes specially crafted input that reaches the vulnerable Hyper-V code path; the CVSS vector indicates this also requires some form of user interaction, such as a user or administrator opening, importing, connecting to, or otherwise interacting with attacker-controlled content or workflow. Because the flaw is improper input validation, Hyper-V mishandles the crafted input and allows code to execute locally. After code execution, the attacker may attempt privilege escalation, credential access, persistence, tampering with virtual machine files or settings, or lateral movement from a virtualization host to other systems. There is no provided evidence that this vulnerability is currently exploited in the wild, associated with ransomware campaigns, or tied to a named threat actor.

How to fix it

Install the Microsoft security update that addresses CVE-2026-32149 for each affected Windows release: Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2016, 2019, 2022, 2022 23H2, and 2025. No exact fixed build or KB numbers were provided in the input, so use the Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Intune, Configuration Manager, or the appropriate offline servicing process to deploy the cumulative update containing the fix. Reboot systems where required. Prioritize Hyper-V hosts, systems used by virtualization administrators, servers hosting sensitive virtual machines, and Windows clients where Hyper-V is enabled. If immediate patching is not possible, reduce exposure by disabling Hyper-V where it is not required, restricting local logon and Hyper-V management permissions, limiting who can import or run untrusted virtual machines or related files, hardening administrator workstations, and monitoring Hyper-V-related activity until updates are applied.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft cumulative update or security update that includes the fix for CVE-2026-32149. Validate OS version and patch level with Windows Update history, WSUS/Intune/Configuration Manager compliance reports, or commands such as `winver`, `systeminfo`, `Get-HotFix`, and applicable build-number checks from the Microsoft Security Update Guide. Confirm whether Hyper-V is present or enabled using Windows Features, Server Manager, `Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All`, or `Get-WindowsFeature Hyper-V` on Windows Server. For systems where Hyper-V is not required, verify the feature is disabled or removed. After patching, confirm Hyper-V services and hosted workloads operate normally and review event logs for abnormal Hyper-V crashes or service restarts around the maintenance window.

Typical attack path

1. Identify a Windows 10, Windows 11, or Windows Server system with Hyper-V installed or enabled.
2. Obtain low-privileged authorized local access to the affected system, or compromise an account that can interact with Hyper-V locally.
3. Prepare crafted input intended to reach the vulnerable Hyper-V validation path.
4. Induce the required user interaction or execute the vulnerable local workflow involving Hyper-V.
5. Trigger the input validation flaw and achieve local code execution.
6. Use the resulting execution to access sensitive data, alter Hyper-V configuration, impact virtual machines, escalate privileges, or move laterally.

How to detect it

There are no unique public indicators provided for exploitation of this vulnerability, and the supplied exploit maturity is none. Detection should therefore focus on behavioral evidence of local exploitation and post-exploitation activity on systems running Hyper-V. Review Windows Security logs for unusual local logons, privilege use, new service creation, scheduled tasks, and suspicious process creation around Hyper-V activity. Review Microsoft-Windows-Hyper-V-VMMS/Admin, Microsoft-Windows-Hyper-V-Worker/Admin, Microsoft-Windows-Hyper-V-Hypervisor/Admin, System, and Application logs for abnormal Hyper-V service failures, worker process crashes, unexpected VM state changes, or configuration changes. If Sysmon or EDR telemetry is available, hunt for unusual child processes spawned near Hyper-V management activity, unexpected access to virtual machine files, credential dumping behavior, and persistence mechanisms created by low-privileged users. Also compare Hyper-V configuration, VM inventory, virtual disk timestamps, checkpoints, and administrator group membership against known-good baselines. Because exploitation requires local access and user interaction, correlate suspicious Hyper-V events with recent interactive logons, file downloads, archive extraction, VM imports, or use of management consoles and scripts.

What your security team should do

• Patch affected Hyper-V hosts and administrator workstations first, even though EPSS is currently low and there is no known KEV listing.
• Use centralized patch reporting to identify Windows 10, Windows 11, and Windows Server systems that are affected and missing the relevant Microsoft security update.
• Inventory where Hyper-V is enabled and remove or disable it on systems that do not require virtualization capabilities.
• Restrict membership in local Administrators, Hyper-V Administrators, and other groups that can manage or interact with Hyper-V locally.
• Block use of untrusted virtual machine images, checkpoints, virtual disks, scripts, and management workflows on production Hyper-V hosts.
• Increase monitoring of Hyper-V service crashes, suspicious local process creation, and changes to virtual machine configuration on unpatched systems.
• Apply least-privilege and privileged access workstation practices for administrators who manage Hyper-V infrastructure.
• If suspicious activity is found, isolate the host, preserve volatile and disk evidence, collect Hyper-V and Windows event logs, and review hosted virtual machines for tampering.