Windows Hyper-V: Local privilege escalation via uninitialized resource

Summary

Windows Hyper-V, the hypervisor component of Windows, contains a use of uninitialized resource flaw that allows an authorized local attacker to elevate privileges. The attack requires high privileges and high attack complexity, but a successful attacker could affect the confidentiality, integrity and availability of the system, including beyond the Hyper-V component (scope changed). Microsoft has released fixes; exploitation status is conflicting between sources and no public proof of concept was found.

Affected

• Windows 11 version 24H2: 10.0.26100.0 to below 10.0.26100.9974
• Windows 11 version 25H2: 10.0.26200.0 to below 10.0.26200.9974
• Windows 11 version 26H1: 10.0.28000.0 to below 10.0.28000.3501
• Windows 11 version 26H2: 10.0.26300.0 to below 10.0.26300.9974 (per third-party tracker, not confirmed by vendor page)
• Windows Server 2025 (including Server Core installation): 10.0.26100.0 to below 10.0.26100.33822
• Windows Server 2019/2022 and older client releases: Unknown.

Fixed in

• Windows 11 version 24H2: 10.0.26100.9974
• Windows 11 version 25H2: 10.0.26200.9974
• Windows 11 version 26H1: 10.0.28000.3501
• Windows 11 version 26H2: Unknown (full build not verified)
• Windows Server 2025 (including Server Core installation): 10.0.26100.33822
• KB article numbers: Unknown; check the MSRC page per edition.

Workaround

• A patch is available; no workaround is needed.
• No vendor-published interim mitigation found.
• Unknown: whether Microsoft documents a Hyper-V-specific interim control.

Exploitation

• Microsoft temporal vector: E:U (exploit code maturity unproven), RC:C (report confidence confirmed).
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• Conflicting reports: a Talos post lists this CVE among vulnerabilities from the release that Microsoft noted as exploited in the wild, but the wording is ambiguous. Unconfirmed.
• One tracker marks it KEV: No.
• No public proof of concept found.

Our recommendation

• Patch Hyper-V hosts and admin workstations in the next regular cycle, using the MSRC page to select the correct KB per edition.
• Restrict and review accounts with administrative rights on Hyper-V hosts.
• Check whether VBS, WSL 2 or Windows Sandbox are enabled on endpoints and treat them as in scope.
• Verify the MSRC exploitability fields and the CISA KEV catalogue; escalate immediately if they show exploitation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119960 msrc.microsoft.com
• CVE Record CVE-2026-119960 (CVE.org) www.cve.org
• Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
• CrowdStrike: Patch Tuesday analysis November 2026 www.crowdstrike.com
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com
• Strix: CVE-2026-119960 (third-party tracker) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:25.