CVE-2026-47652

What it actually does

This vulnerability is an out-of-bounds read in Windows Hyper-V. A local attacker with high privileges can trigger improper memory access in the Hyper-V component and cause the hypervisor or related virtualization boundary code to read memory outside the intended buffer. Because the CVSS scope is changed and confidentiality, integrity, and availability impacts are high, successful exploitation may allow local code execution in a more privileged or isolated context, potentially affecting host or virtualized workload boundaries. The attack requires local access, no user interaction, low complexity, and high privileges.

Why it matters to the business

Organizations running affected Windows 11 or Windows Server systems with Hyper-V enabled could face compromise of virtualization hosts or workloads if an already-privileged local attacker exploits the flaw. This is most concerning on virtualization servers, developer workstations, VDI infrastructure, build systems, and systems that host multiple workloads, because a local privilege boundary failure can undermine workload isolation and lead to broader service disruption, data exposure, or host compromise. The issue is not currently listed in CISA KEV, has no known public exploit maturity reported, and has a low EPSS score, so immediate internet-scale exploitation is less likely; however, the high CVSS impact means it should still be prioritized for systems where Hyper-V is enabled or untrusted users/workloads can obtain local privileged access.

How an attack unfolds

An attacker must first obtain local access to an affected Windows system and already hold high privileges. They then interact with Hyper-V functionality in a way that reaches the vulnerable code path and supplies crafted input or state that causes an out-of-bounds memory read. If exploitation is reliable, the attacker may use the memory disclosure or resulting memory corruption behavior to execute code locally in a more privileged context or across a virtualization trust boundary. In a realistic intrusion, this would likely be used after initial compromise and privilege escalation, as a post-exploitation technique to attack a Hyper-V host, escape isolation assumptions, tamper with workloads, or disrupt virtualized services.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-47652 for all affected Windows versions, including Windows 11 23H2, 24H2, 25H2, 26H1, Windows Server 2022, and Windows Server 2025. No fixed version numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the applicable cumulative update for each operating system release. Prioritize Hyper-V hosts, virtualization clusters, VDI hosts, systems running untrusted or multi-tenant workloads, and administrative/developer workstations with Hyper-V enabled. If immediate patching is not possible, reduce exposure by disabling Hyper-V where not required, limiting local administrator access, restricting who can create or manage virtual machines, hardening host access, isolating high-risk workloads, and monitoring privileged local activity on Hyper-V systems.

How to confirm the fix worked

Confirm that affected systems have installed the relevant Microsoft cumulative security update released for this vulnerability or a later superseding update. Validate patch deployment through Windows Update history, installed hotfix inventory, endpoint management tooling, or vulnerability scanner checks that map to CVE-2026-47652. Verify whether Hyper-V is enabled on Windows clients and servers, and prioritize any unpatched systems where the Hyper-V role, hypervisor services, or virtualization-based security components are active. Where possible, perform authenticated vulnerability scanning and compare OS build numbers against Microsoft’s patched build guidance for the relevant Windows release. Also confirm that local administrator and Hyper-V administrator group memberships are limited to expected accounts.

Typical attack path

1. Gain local access to an affected Windows 11 or Windows Server system.
2. Obtain high local privileges required to reach the vulnerable Hyper-V attack surface.
3. Confirm Hyper-V or related virtualization components are present and enabled.
4. Trigger the vulnerable Hyper-V code path using crafted local interaction with the virtualization subsystem.
5. Use the out-of-bounds read condition to disclose sensitive memory or support code execution in a higher-impact context.
6. Establish persistence, access host or workload data, tamper with virtualized resources, or cause service disruption.

How to detect it

Because exploitation requires local high privileges and no public exploit indicators are provided, detection should focus on signs of suspicious privileged activity around Hyper-V and post-exploitation behavior. Review Windows Security logs for unexpected administrator logons, new local administrator or Hyper-V administrator membership, service creation, scheduled tasks, and privileged command execution. Review Hyper-V-VMMS, Hyper-V-Hypervisor, Hyper-V-Worker, System, and Application event logs for unusual VM management activity, hypervisor or VM worker crashes, unexpected VM state changes, and error bursts near suspicious logon sessions. Endpoint detection telemetry should be searched for untrusted binaries interacting with Hyper-V management tools, unexpected use of PowerShell Hyper-V cmdlets, vmms.exe or vmwp.exe instability, and local privilege-escalation tradecraft preceding Hyper-V activity. Since there are no known public exploit artifacts in the input, absence of these indicators does not prove non-exploitation; correlate logon, process, crash, and VM-management timelines on patched and formerly vulnerable hosts.

• Microsoft-Windows-Hyper-V-VMMS
• Microsoft-Windows-Hyper-V-Hypervisor
• Microsoft-Windows-Hyper-V-Worker
• vmms.exe
• vmwp.exe
• vmmem.exe
• Get-VM
• Set-VM
• New-VM
• Start-VM
• Stop-VM
• Add-VMGroupMember
• Hyper-V Administrators
• Event ID 4624
• Event ID 4672
• Event ID 4688
• Event ID 4728
• Event ID 4732
• Event ID 7045

What your security team should do

• Inventory Windows 11 and Windows Server 2022/2025 systems and identify where Hyper-V or virtualization features are enabled.
• Patch Hyper-V hosts and systems with privileged local users first, even though the vulnerability is not currently in KEV and has low EPSS.
• Review and reduce membership in local Administrators, Hyper-V Administrators, and other virtualization-management roles.
• Disable Hyper-V or unnecessary virtualization features on systems that do not require them.
• Increase monitoring on Hyper-V hosts for unusual privileged process execution, VM configuration changes, service crashes, or unexpected hypervisor-related errors.
• Use authenticated vulnerability scanning or endpoint management inventory to verify that applicable cumulative updates are installed.
• Treat suspected exploitation as post-compromise activity: investigate how the attacker obtained local high privileges before attempting this vulnerability.