IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows Hyper-V: Elevation of privilege via TOCTOU race condition

CVE-2026-113865High 7.8

← All vulnerabilities

Summary

A time-of-check time-of-use race condition in Windows Hyper-V allows an authorized local attacker to elevate privileges. The attacker must already have a foothold in a guest VM or on the local system and must win a race condition. Hyper-V is not reachable from the internet, but the risk is relevant for hosts with shared or untrusted guest VMs and for endpoints with VBS, Windows Sandbox or WSL2 enabled.

Affected

  • Windows 10 Version 21H2 before 10.0.19044.7846
  • Windows 10 Version 22H2 before 10.0.19045.7846
  • Windows 11 Version 23H2 before 10.0.22631.7711
  • Windows 11 Version 24H2 before 10.0.26100.9974
  • Windows 11 Version 25H2 before 10.0.26200.9974
  • Windows 11 Version 26H1 before 10.0.28000.3501
  • Windows 11 Version 26H2 before 10.0.26300.9974
  • Windows Server 2022 before 10.0.20348.5870
  • Windows Server 2025 (including Server Core) before 10.0.26100.33822

The research notes do not confirm all of these entries. Verify the affected software table on MSRC.

Fixed in

  • Install the November 2026 Microsoft security update. Fixed builds are listed above.
  • No separate KB number has been confirmed for this CVE.

Workaround

  • Unknown. Microsoft lists no mitigation that could be confirmed. Patch first.
  • Where patching is delayed: limit access to guest VMs, separate untrusted workloads from sensitive ones, and monitor Hyper-V hosts (generic advice, not from Microsoft).

Exploitation

  • Microsoft assessment: Exploitation Less Likely; exploitation requires winning a race condition.
  • CISA SSVC: exploitation none, not automatable, total technical impact.
  • Talos and Qualys report one vulnerability in this release as exploited in the wild; this is not confirmed for CVE-2026-113865.
  • Public proof of concept: unknown.

Our recommendation

  • Patch Hyper-V hosts first, then Windows endpoints with VBS, Windows Sandbox or WSL2 enabled.
  • Verify installed build numbers after patching.
  • Review which guest VMs are shared with contractors or other tenants and restrict access.
  • Monitor Hyper-V hosts for unusual activity.
  • Recheck the NVD score, as the status was Awaiting Analysis at the time of research.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Critical
Impact
Elevation of privilege – Windows Hyper-V
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131096, KB5131090, KB5131087, KB5132061, KB5132043, KB5131080

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:06.

Original description (NVD)

Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed