Microsoft Windows Hyper-V: Use after free allows local privilege escalation
Summary
A use-after-free vulnerability (CWE-416) in Windows Hyper-V allows an authorized local user to elevate privileges. Exploitation requires local access and low privileges, and no user interaction. The CVSS 3.1 base score is 7.8 (High), and the risk is greatest on Hyper-V hosts and multi-user systems.
Affected
- Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
- Windows 10 Version 21H2: builds before 10.0.19044.7807
- Windows 10 Version 22H2: builds before 10.0.19045.7807
- Windows 11 Version 23H2: builds before 10.0.22631.7652
- Windows 11 Version 24H2: builds before 10.0.26100.9711
- Windows 11 Version 25H2 and 26H2: builds before 10.0.26200.9711 and 10.0.26300.9711
- Windows 11 Version 26H1: builds before 10.0.28000.3231
- Windows Server 2022: builds before 10.0.20348.5761
- Windows Server 2025 (including Server Core): builds before 10.0.26100.33650
Fixed in
- Install the Microsoft update for the October 2026 release that brings your system to the fixed build listed in the CVE record.
- Windows 10 1809 and Server 2019: 10.0.17763.9376 or later
- Windows 10 21H2: 10.0.19044.7807 or later
- Windows 10 22H2: 10.0.19045.7807 or later
- Windows 11 23H2: 10.0.22631.7652 or later
- Windows 11 24H2: 10.0.26100.9711 or later
- Windows 11 25H2 and 26H2: 10.0.26200.9711 or later and 10.0.26300.9711 or later
- Windows 11 26H1: 10.0.28000.3231 or later
- Windows Server 2022: 10.0.20348.5761 or later
- Windows Server 2025: 10.0.26100.33650 or later
- Third-party sources name KB5126651 for 1809; verify the exact update on the MSRC page.
Workaround
Unknown. No Microsoft workaround or mitigation for this CVE was found.
Exploitation
- No evidence of in-the-wild exploitation or a public proof of concept was found.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Install the latest October 2026 cumulative update for each affected system, and verify the fixed build on the MSRC page.
- Prioritize Hyper-V hosts and multi-user systems. Review local accounts and restrict local logon where possible.
- Plan the replacement of Windows 10 1809 systems, as support has ended except for LTSC and ESU editions. Windows Server 2019 support runs until January 2029.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Hyper-V
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126657, KB5126655, KB5126653, KB5127648, KB5126646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-70023 msrc.microsoft.com
- Vulners CVE record (CNA data) vulners.com
- Strix CVE summary www.strix.ai
- Microsoft support: KB5122876 (Windows 10 1809 security update) support.microsoft.com
- Microsoft Update Catalog: KB5126651 www.catalog.update.microsoft.com
- NinjaOne KB catalog: KB5126651 www.ninjaone.com
- Wikipedia: Windows 10 en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:32.
Original description (NVD)
Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.