Windows Hyper-V: Spoofing vulnerability due to improper input validation

Summary

A spoofing vulnerability in the Windows Hyper-V virtualization component stems from improper validation of the syntactic correctness of input. An authorized local attacker with low privileges can exploit it without user interaction and affect confidentiality, integrity and availability with a changed scope (CVSS 8.8). Only hosts with the Hyper-V role are relevant, and the vulnerability is not internet-exposed.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Fixed builds according to the CVE record (October 2026 security update): 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2)
• KB number for Windows 10 Version 1607: Unknown.
• Verify the build numbers on the Microsoft Security Update Guide before rollout.

Workaround

• No Microsoft-documented workaround known.
• If the Hyper-V role is not needed, disabling or removing it removes the attack surface (advice from a third-party source, not from Microsoft).

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not listed in the CISA KEV catalog (according to OpenCVE).
• No public proof of concept found in our searches; absence is not confirmed.
• EPSS about 0.24 percent.
• Public disclosure by the vendor: Unknown.

Our recommendation

• Inventory all hosts with the Hyper-V role, including Windows Server 2016, 2019, 2022 and 2025 as well as Windows 10/11 clients.
• Install the October 2026 security update on affected Hyper-V hosts within the normal patch cycle; priority medium.
• Check whether any Windows 10 Version 1607 hosts are still in use and still receive updates; the end of support date is not verified in the sources.
• If Hyper-V is not required, consider disabling the role.
• Restrict local logon and administrative rights on Hyper-V hosts and monitor for suspicious local activity.
• Monitor the CISA KEV catalog for a change in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83728 msrc.microsoft.com
• OpenCVE: CVE-2026-83728 app.opencve.io
• Vulners NVD: CVE-2026-83728 vulners.com
• Vulners VulnRichment: CVE-2026-83728 vulners.com
• Qualys: Microsoft Patch Tuesday October 2026 review blog.qualys.com
• Strix: CVE-2026-83728 build data (third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:34.