CVE-2026-21247CWE-122CWE-125CWE-20

Windows Hyper-V Remote Code Execution Vulnerability

High · published February 10, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

⚡ A crafty attacker with local access can exploit improper input validation in Windows Hyper-V to run malicious code. It's like a trusted hotel guest slipping a prank note under the manager's door—potential chaos! 🔥 Think of this vulnerability as a hotel that doesn’t check IDs at check-in. An authorized guest could misuse their access to sneak in an unauthorized guest (malicious code), leading to some unexpected and unwanted room service! If exploited, this vulnerability could enable an attacker to execute arbitrary code, leading to potential data breaches or system compromises. Imagine losing valuable data or having your system manipulated without your knowledge—utterly alarming!

Put simply

Think of this vulnerability as a hotel that doesn’t check IDs at check-in. An authorized guest could misuse their access to sneak in an unauthorized guest (malicious code), leading to some unexpected and unwanted room service! CVE-2026-21247 arises from improper input validation in Windows Hyper-V, allowing an authorized user to send crafted inputs that the system fails to properly validate, leading to code execution.

What to do

If exploited, this vulnerability could enable an attacker to execute arbitrary code, leading to potential data breaches or system compromises. Imagine losing valuable data or having your system manipulated without your knowledge—utterly alarming! To mitigate this risk, ensure you apply the latest security patches provided by your operating system. Regularly review user access permissions to limit exposure and enforce robust input validation wherever inputs are accepted. 🛡️ You've got this! Stay proactive and secure your systems now! 💪✨

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00585 · 47.2th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-125 · Out-of-bounds Read; CWE-20 · Improper Input Validation
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Windows Hyper-V Remote Code Execution Vulnerability
    cvelistv5