CVE-2026-105733 – Windows Hyper-V Remote Code Execution Vulnerability

Microsoft has identified a critical Remote Code Execution (RCE) vulnerability in Windows Hyper-V that could allow an authenticated attacker to escape a virtual machine and execute malicious code on the underlying host environment. The vulnerability, caused by improper access control, allows attackers with low-level privileges to run a specially crafted application inside a Hyper-V guest virtual machine. Successful exploitation could compromise the security boundaries between virtual machines and their hosts, potentially exposing sensitive information, allowing unauthorized system modifications, and disrupting business operations. Although exploitation is currently considered less likely, the potential impact on virtualized environments makes this an important security update.

CVSS SCORE: 8.8

SEVERITY: Critical

Threat

This vulnerability presents a significant security threat to organizations using Microsoft Hyper-V virtualization technology.

An attacker with low-level privileges inside a Hyper-V guest environment could exploit improper access controls to execute arbitrary code outside the intended virtual machine security boundary.

The vulnerability is particularly concerning because it could allow an attacker operating within a nested virtual machine to escape that environment and gain administrative privileges on the guest operating system acting as its host.

Successful exploitation could result in:

• Virtual Machine Escape: Attackers could break through virtualization security boundaries and access systems outside their assigned virtual machine.
• Privilege Escalation: Attackers could gain administrative privileges on the affected hosting environment.
• Unauthorized Code Execution: Malicious applications could execute arbitrary code on the targeted host operating system.
• Sensitive Data Exposure: Attackers could potentially access confidential information stored or processed within compromised systems.
• Service Disruption: Compromised virtualization environments could experience operational disruptions, affecting business applications and services.

The vulnerability has a low attack complexity, meaning exploitation does not require sophisticated attack conditions once the attacker has the necessary access.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication, the vulnerability was:

• Publicly Disclosed: No
• Actively Exploited: No
• Exploit Code Maturity: Unproven

There is no confirmed evidence of active exploitation or publicly available proof-of-concept (PoC) exploit code.

The vulnerability has not been identified as an actively exploited zero-day.

However, the vulnerability’s low attack complexity and potential to bypass virtualization boundaries make it a security concern.

An attacker who successfully exploits this weakness could execute arbitrary code and gain elevated privileges within the affected hosting environment.

Technical Summary

CVE-2026-105733 is a critical Remote Code Execution vulnerability affecting Microsoft Windows Hyper-V.

The vulnerability originates from CWE-284: Improper Access Control, which occurs when a system fails to enforce appropriate restrictions on access to protected resources or operations.

Hyper-V uses virtualization boundaries to isolate guest operating systems from their hosting environments. These boundaries are essential for preventing applications or processes running inside one virtual machine from interfering with other systems.

This vulnerability could allow an attacker to bypass those boundaries.

To exploit the vulnerability, an attacker could execute a specially crafted application within a Hyper-V guest virtual machine.

The malicious application could trigger the access control weakness, causing the Hyper-V host operating system to execute arbitrary code.

In nested virtualization environments, an attacker operating inside a nested guest virtual machine could potentially escape that virtual machine and obtain administrative privileges on the guest operating system serving as its host.

The vulnerability has the following technical characteristics:

• Attack Vector: Local — Exploitation requires access to the affected virtualized environment.
• Attack Complexity: Low — No complex exploitation conditions are required.
• Privileges Required: Low — An attacker needs only limited privileges.
• User Interaction: None — No additional user interaction is required.
• Scope: Changed — Successful exploitation can affect resources outside the original security boundary.
• Confidentiality Impact: High — Sensitive information could be exposed.
• Integrity Impact: High — Attackers could modify protected system resources.
• Availability Impact: High — Exploitation could disrupt affected systems.

The combination of low attack complexity, limited privilege requirements, and no user interaction makes this vulnerability particularly concerning.

Although exploitation requires an existing level of access, successful exploitation could allow attackers to move beyond their initial security boundaries.

Exploitability

The vulnerability affects the following Microsoft products and operating systems:

• Windows 10: Versions 21H2 and 22H2 (x64).
• Windows 11: Versions 23H2, 24H2, 25H2, and 26H1 (ARM64 and x64).
• Windows Server 2022: Including Server Core installations.
• Windows Server 2025: Including Server Core installations.
• Microsoft Visual Studio 2026: Version 18.10.

An authenticated attacker with low privileges could exploit the vulnerability by running a specially crafted application inside a Hyper-V guest virtual machine.

Successful exploitation could allow arbitrary code execution on the hosting environment.

Business Impact

This vulnerability poses a significant risk to organizations that depend on Hyper-V for server virtualization, application hosting, development environments, and business-critical workloads.

Virtualization security boundaries are designed to prevent compromised virtual machines from affecting their underlying hosts.

CVE-2026-105733 threatens that separation.

A single compromised virtual machine could become an entry point into a more privileged hosting environment, potentially turning a contained security incident into a wider infrastructure compromise.

The potential business consequences include:

• Infrastructure Compromise: Attackers could gain elevated privileges within hosting environments, potentially compromising critical infrastructure components.
• Data Security Risks: Unauthorized access could expose sensitive business information, application data, and confidential workloads.
• Operational Disruption: Successful attacks could interfere with virtualized workloads and interrupt essential business services.
• Increased Attack Reach: Escaping a virtual machine could give attackers access to resources beyond their original environment.
• Financial and Reputational Damage: Security incidents involving critical infrastructure could lead to recovery costs, business interruptions, and loss of customer confidence.

Organizations hosting multiple workloads within virtualized environments should pay particular attention to this vulnerability.

When virtualization boundaries fail, the impact can extend far beyond a single compromised machine.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

Organizations should prioritize installing the appropriate security updates.

The following security updates are identified for affected products:

• KB5126657: Windows 10 versions 21H2 and 22H2.
• KB5126653: Windows 11 version 23H2.
• KB5127648: Windows 11 versions 24H2 and 25H2, and Microsoft Visual Studio 2026 version 18.10.
• KB5127646: Windows 11 version 26H1.
• KB5126655: Windows Server 2022.
• KB5126646: Windows Server 2025.

A system restart is required after installing the applicable updates.

Urgency

Critical Priority – Deploy Security Updates Promptly

CVE-2026-105733 carries a critical severity rating and a CVSS base score of 8.8.

Although Microsoft considers exploitation less likely and has not reported active exploitation, the vulnerability could allow attackers to escape virtual machine boundaries and execute arbitrary code within more privileged environments.

The vulnerability is especially concerning because exploitation requires only low privileges, has low attack complexity, and does not require user interaction.

Organizations should prioritize patch deployment across affected Hyper-V environments, particularly systems supporting critical business applications and nested virtualization workloads.

Delaying this update could leave important virtualization security boundaries exposed to attackers who already have access to a guest environment.

Deploying the security updates promptly will help reduce the risk of unauthorized code execution, privilege escalation, and potential infrastructure compromise.