CVE-2026-72961 – Windows Hyper-V Elevation of Privilege Vulnerability

CVE-2026-72961 is a Critical Windows Hyper-V elevation-of-privilege vulnerability. An authorized attacker with administrative access to an affected Hyper-V host can supply specially crafted virtual TPM state data to a virtual machine. Successful exploitation can cross a security boundary and grant Virtual Trust Level 1 (VTL1) privileges. The vulnerability requires local access and high privileges but does not require user interaction.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability presents a significant privilege-escalation threat to affected Hyper-V environments. Attack complexity is Low, scope is Changed, and successful exploitation can have High impact on confidentiality, integrity, and availability. Exploitation requires high privileges and a local attack path, which limits the initial attack opportunity but makes the vulnerability important where an attacker already has administrative access to a Hyper-V host.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Its exploitability assessment is Exploitation Unlikely, and exploit code maturity is classified as Unproven. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-72961 affects Windows Hyper-V and is associated with CWE-122, Heap-based Buffer Overflow. The vulnerability description identifies an out-of-bounds read that allows an authorized local attacker to elevate privileges. An attacker with administrative access to an affected Hyper-V host can supply specially crafted virtual TPM state data to a virtual machine. If exploitation succeeds, the attacker can cross a security boundary and obtain VTL1 privileges. The CVSS metrics identify a local attack vector, low attack complexity, high privileges required, no user interaction, changed scope, and High confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations and supported architectures. Exploitation requires administrative access to the Hyper-V host and specially crafted virtual TPM state data.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already controls an administrative account on a Hyper-V host to cross a security boundary and gain VTL1 privileges. Because the rated impact to confidentiality, integrity, and availability is High, exploitation could create serious security consequences for systems relying on the affected Hyper-V environment. *“High privileges are required to start the attack, but successful exploitation can push that access across another security boundary.”*

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and has a CVSS base score of 8.2. Although exploitation is assessed as unlikely and there is no identified active or public exploitation, successful exploitation can cross a security boundary and affect confidentiality, integrity, and availability at a High level. Organizations operating affected Hyper-V systems should prioritize deployment of the applicable security update.