CVE-2026-40402

What it actually does

CVE-2026-40402 is a use-after-free vulnerability in Windows Hyper-V. A local attacker who can run code on an affected Windows 11 23H2 or Windows Server 2022 system may be able to manipulate freed Hyper-V-related memory so it is reused in an attacker-controlled way, resulting in privilege escalation. Because the CVSS scope is changed with high confidentiality, integrity, and availability impact, successful exploitation could allow execution with highly privileged context, potentially including SYSTEM, kernel-level, or Hyper-V host-level privileges depending on the vulnerable code path.

Why it matters to the business

Successful exploitation could let an attacker who has obtained any local execution foothold turn that limited access into full control of an affected Windows endpoint or server. On systems using Hyper-V, this is especially serious because compromise of virtualization components can threaten hosted workloads, management tooling, and administrative trust boundaries. The CVSS score is critical, but current public exploitation indicators are low: EPSS is 0.00332, unchanged over 30 days, it is not listed in CISA KEV, and exploit maturity is currently reported as none. Organizations should still prioritize remediation for Hyper-V hosts, developer workstations using virtualization, and Windows Server 2022 systems running virtualized workloads because privilege escalation flaws are commonly chained with initial-access techniques.

How an attack unfolds

An attacker first needs local code execution on an affected Windows system; this could come from malware execution, stolen interactive access, abuse of a low-privileged account, or exploitation of a separate vulnerability. The attacker then invokes the vulnerable Hyper-V functionality from local context and causes the affected component to free an object while a usable reference remains. By carefully influencing subsequent memory allocation, the attacker attempts to reclaim that freed memory with controlled data. When Hyper-V later dereferences the stale pointer, the attacker-controlled structure can redirect execution or corrupt privileged state. If successful, the attacker elevates from an unprivileged local context to a highly privileged Windows or Hyper-V context, allowing credential access, defense evasion, persistence, tampering with workloads, or full host takeover. There are no named threat actors or known ransomware use reported for this vulnerability in the provided data.

How to fix it

Apply the applicable Microsoft security update for the affected Windows versions as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Intune, or other enterprise patching tools. The provided fixed_versions field does not list specific build numbers, so remediation should be tracked against Microsoft’s official advisory and monthly cumulative update guidance for Windows 11 23H2 and Windows Server 2022. Prioritize Hyper-V hosts and systems where untrusted users can execute code. Where immediate patching is not possible, reduce exposure by disabling Hyper-V on systems that do not require it, restricting local logon and code execution rights, limiting access to virtualization management interfaces, enforcing application control, and hardening endpoint protection against local privilege escalation chains. Mitigations should be treated as temporary because memory-safety privilege escalation flaws generally require vendor patches for complete remediation.

How to confirm the fix worked

Confirm affected assets are running a Windows build that includes Microsoft’s fix for this vulnerability. Validate patch deployment using centralized patch inventory, Windows Update history, endpoint management reporting, or PowerShell-based build checks. Confirm whether Hyper-V is enabled on systems by reviewing installed Windows optional features and server roles. After remediation, verify that Windows cumulative updates installed successfully and that no rollback occurred. For mitigation validation, confirm Hyper-V is disabled where not required, non-administrative users cannot install or run unapproved local code, and virtualization administration is limited to authorized administrators. Because fixed versions were not provided in the input, validation should be mapped to Microsoft’s official KB/build numbers for the release channel in use.

Typical attack path

1. Gain local code execution on an affected Windows 11 23H2 or Windows Server 2022 system.
2. Confirm Hyper-V or related virtualization components are present and reachable from the local context.
3. Trigger the vulnerable Hyper-V code path that mishandles object lifetime and creates a use-after-free condition.
4. Shape memory so the freed object is replaced with attacker-controlled data.
5. Force the vulnerable component to reuse the stale reference.
6. Achieve privileged code execution or privileged state corruption.
7. Use elevated privileges to disable defenses, access credentials, tamper with workloads, install persistence, or move laterally.

How to detect it

There are no reliable vulnerability-specific exploitation indicators in the provided data, and local use-after-free exploitation often leaves few unique artifacts. Detection should focus on signs of successful local privilege escalation and Hyper-V host compromise. Review Windows Security logs for unexpected privilege changes, new local administrator membership, new services, scheduled tasks, unusual logon patterns, and privileged token use shortly after low-privileged execution. Review System and Application logs for Hyper-V component crashes, service instability, unexpected restarts, or faulting processes around the suspected time window. Review Microsoft-Windows-Hyper-V-* event channels where available, as well as EDR telemetry for unusual child processes, unsigned binaries, memory injection, credential dumping, tampering with security tools, or commands executed by newly elevated processes. On Hyper-V hosts, correlate guest activity, management operations, and host administrative events. Because no public exploit maturity or threat actor activity is reported, detections should be behavioral rather than signature-only.

What your security team should do

• Inventory Windows 11 23H2 and Windows Server 2022 systems, especially Hyper-V hosts and developer workstations using virtualization.
• Patch affected systems through the appropriate Microsoft cumulative update as soon as the fix is available and validated.
• Prioritize externally managed, shared, multi-user, and virtualization-host systems even though current EPSS and exploit maturity are low.
• Temporarily disable Hyper-V on systems where it is not operationally required.
• Restrict local interactive access and local code execution opportunities for non-administrative users.
• Use application control, attack surface reduction rules, and endpoint detection controls to reduce the chance of chaining this flaw after initial access.
• Monitor for suspicious post-exploitation behavior such as unexpected privilege escalation, new local administrators, credential dumping, defense tampering, and unusual activity on Hyper-V hosts.
• Track Microsoft advisory updates for fixed build numbers because no exact fixed versions were provided in the input.