CVE-2026-105733

Summary

Windows Hyper-V suffers from improper access control that allows authorized users to execute arbitrary code locally on the host system. This represents a significant privilege escalation vulnerability where a local attacker can potentially break out of virtual machine isolation and compromise the entire host.

Exploitability

Exploitation requires a local authenticated user with access to Hyper-V services, which is moderately difficult but achievable in environments where users have legitimate administrative access or are running virtual machines.

Blast radius

If exploited, this vulnerability could allow attackers to execute code on the Hyper-V host system, potentially leading to complete compromise of all virtual machines hosted on that system and enabling lateral movement throughout the network.

Detection

Monitor for unusual Hyper-V service access patterns in Windows Event Logs, particularly Event ID 4200 and 4201 related to virtual machine configuration changes, and look for unexpected process creation from Hyper-V management services.

Prioritized remediation

Apply the latest Windows updates including KB5042819 or later, which contain the necessary fixes for this Hyper-V access control flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.