CVE-2026-21255CWE-284

Windows Hyper-V Security Feature Bypass Vulnerability

High · published February 10, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

⚡ A local attacker can waltz right past security checks in Windows Hyper-V, like a guest slipping into a backstage area without a ticket! 🎭 Picture a hotel where only VIPs are supposed to access the exclusive lounge, but one sneaky guest finds a way in through a back door that was never locked. This vulnerability lets an authorized user bypass security controls in the system, which could lead to unauthorized access! By exploiting this flaw, an attacker can access sensitive areas and potentially execute malicious actions, compromising the integrity of the entire virtual environment. This could lead to unauthorized data exposure or manipulation, making it a serious threat to security.

Put simply

Picture a hotel where only VIPs are supposed to access the exclusive lounge, but one sneaky guest finds a way in through a back door that was never locked. This vulnerability lets an authorized user bypass security controls in the system, which could lead to unauthorized access! This vulnerability arises from improper access control mechanisms in Windows Hyper-V, allowing an attacker with local access to bypass intended security features. Essentially, it enables a user to escalate their privileges and gain unauthorized access within the hypervisor environment.

What to do

By exploiting this flaw, an attacker can access sensitive areas and potentially execute malicious actions, compromising the integrity of the entire virtual environment. This could lead to unauthorized data exposure or manipulation, making it a serious threat to security. To mitigate this risk, ensure you have the latest updates installed for Windows Hyper-V and regularly check for patches that address this vulnerability. Review your access control policies to limit local access and monitor user activity closely. You've got this! With a few updates and some vigilance, you can keep your virtual environment safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-02-10T17:51Z
EPSS history
Timeline
  • 10 FEB 17:51Z
    Windows Hyper-V Security Feature Bypass Vulnerability
    cvelistv5