Windows 10 Hyper-V: Privilege escalation via link following

Summary

A link-following flaw (CWE-59) in Windows Hyper-V allows an authorized local user to elevate privileges. The attacker needs a low-privileged local account and no user interaction. The CVSS 3.1 base score is 7.8 (High), with high impact on confidentiality, integrity and availability. Windows 10 Version 1607 (LTSB 2016) reached end of support on 13 October 2026, so fixes for it depend on ESU.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809, 21H2, 22H2, Windows 11 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2012, 2012 R2 and 2016 (including Server Core installations)

Fixed in

• According to the CVE record, fixed builds are 10.0.14393.9612 (Windows 10 1607 and Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2).
• The fixed build for Windows 10 1607 is not yet confirmed by a primary source. Verify it on the MSRC Security Update Guide.
• Windows 10 Version 1607 (LTSB 2016) reached end of support on 13 October 2026. The fix is available only through ESU; confirm this with Microsoft.

Workaround

• Unknown. No vendor workaround was found.
• Restrict local logon to trusted users and disable Hyper-V where the role is not needed (recommendation, not vendor guidance).

Exploitation

• Not listed in the CISA KEV catalog.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS is below 1%.
• No public proof of concept or in-the-wild exploitation was found. This is not a confirmed absence.

Our recommendation

• Check whether Windows 10 1607 (LTSB 2016) or Windows Server 2012, 2012 R2 or 2016 systems with Hyper-V are in use.
• Confirm ESU eligibility with Microsoft and install the update where available. Plan migration off LTSB 2016.
• Prioritise shared, kiosk, point-of-sale and OT-adjacent systems.
• Restrict local logon, disable unneeded Hyper-V roles and monitor for unexpected local privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85343 msrc.microsoft.com
• NVD record via Vulners: CVE-2026-85343 vulners.com
• OpenCVE: CVE-2026-85343 app.opencve.io
• Rapid7 record via Vulners: CVE-2026-85343 vulners.com
• Microsoft Tech Community: Windows Server 2016 and Windows 10 2016 LTSB end of support techcommunity.microsoft.com
• Heise: Windows 10 LTSB and Server 2016 support ends www.heise.de
• 4sysops: Windows 10 Enterprise LTSB 2016 ESU activation 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:24.