Windows Hyper-V: Security feature bypass due to improper certificate validation
Summary
Improper certificate validation in Windows Hyper-V allows a local attacker to bypass a security feature. The attacker must already have administrator privileges on the system, so this is a follow-on step after an initial compromise rather than an internet entry point. The CVSS vector rates the impact on confidentiality, integrity and availability as high on affected hosts.
Affected
- Windows 10 Version 1607 (before 10.0.14393.9688)
- Windows 10 Version 1809 (before 10.0.17763.9487)
- Windows 10 Version 21H2 (before 10.0.19044.7846)
- Windows 10 Version 22H2 (before 10.0.19045.7846)
- Windows 11 Version 23H2 (before 10.0.22631.7711; listed in the CVE record, one third-party source differs)
- Windows 11 Version 24H2 (before 10.0.26100.9974)
- Windows 11 Version 25H2 (before 10.0.26200.9974)
- Windows 11 Version 26H1 (before 10.0.28000.3501)
- Windows 11 Version 26H2 (before 10.0.26300.9974)
- Windows Server 2016, including Server Core (before 10.0.14393.9688)
- Windows Server 2019, including Server Core (before 10.0.17763.9487)
- Windows Server 2022 (before 10.0.20348.5870)
- Windows Server 2025: Unknown, not listed in the CVE record
Fixed in
- Install the November 2026 security update for each affected build. A third-party mirror reports KB5131096 for Windows 10 21H2; the Microsoft KB pages were not verified.
- Confirm the fixed build numbers for your exact edition in the MSRC advisory before patching.
Workaround
Unknown. No vendor mitigation was found in the sources reviewed.
- Not a vendor measure: on hosts that do not need the Hyper-V role, disable the role to remove the attack surface.
Exploitation
- Not known to be exploited in the wild (third-party KB: Exploited: No).
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Inventory all Windows hosts with the Hyper-V role, including Windows Server and Windows 10/11 clients.
- Include the November 2026 cumulative update in the next patch cycle, after verifying the affected builds in MSRC.
- Disable Hyper-V on hosts that do not need it.
- Limit local administrator accounts, since exploitation requires administrator rights.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Security feature bypass – Windows Hyper-V
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org record CVE-2026-95910 www.cve.org
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- CVE list release batch 2026-11-11 github.com
- Strix tracker CVE-2026-95910 (third-party) www.strix.ai
- Senserva KB 5131096 mirror (third-party) senserva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:30.
Original description (NVD)
Improper certificate validation in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.