CVE-2026-54127

Hyper-V is Windows’ built-in virtualization feature, used to run virtual machines on a server. This vulnerability is like a “stale memory” mistake inside Hyper-V that can let someone who already has local access gain higher privileges than they should. If an attacker can reach the Hyper-V environment locally, they may be able to take control of more of the system than intended.

This matters if you run Hyper-V on Windows 11, Windows Server 2022, or Windows Server 2025—especially if that Hyper-V environment is reachable by someone who could get local access (for example, an insider, compromised workstation, or someone with physical/remote access to the host). The vulnerability does not require a login or user interaction, but it still requires local access to the Hyper-V environment to be practical. If you don’t use Hyper-V on these systems (or you have strong controls preventing local access), your risk is lower.

Mark this as urgent because the flaw can elevate privileges locally without authentication or user interaction, which is the kind of condition attackers look for after they get a foothold. Even though CISA’s KEV list does not include this issue and there’s no clear dated public exploitation claim in the findings, the impact is high and Microsoft has released fixes—so you should patch based on exposure to Hyper-V rather than waiting.

1. Identify exposure

   • Confirm whether Hyper-V is installed and in active use on the affected machines (Windows 11, Windows Server 2022, Windows Server 2025).
   • Also check whether any of these hosts are accessible to people or systems that could provide local access (e.g., shared administrative environments, remote support tools, or less-controlled admin accounts).

2. Confirm current patch level

   • On each affected host, check the exact Windows build/version.
   • Determine which fixed version applies to your device/branch:
     • Windows 11: fixed in 10.0.26100.8875 or 10.0.28000.2525
     • Windows Server 2022: fixed in 10.0.20348.5386
     • Windows Server 2025: fixed in 10.0.26100.33158

3. Upgrade/patch

   • Install the Microsoft update corresponding to CVE-2026-54127 from the MSRC update guide.
   • After reboot (if required by the update), re-check the build/version to ensure it matches or exceeds the relevant fixed version.

4. If you cannot patch right away (temporary risk reduction)

   • Tighten access to the Hyper-V hosts to reduce “local access” paths: restrict local logon rights, limit who can access the console/management interfaces, and review remote access mechanisms that could allow an attacker to run code locally on the host.
   • Prioritize patching the most exposed Hyper-V hosts first (any host with higher likelihood of local access).

5. What to monitor

   • Review logs for signs of unusual local activity around Hyper-V hosts (new local admin activity, unexpected processes launched on the host, or configuration changes related to virtualization).

CISA due date: not provided in the findings (not listed in KEV).

This is a local elevation of privilege vulnerability in Windows Hyper-V caused by a use-after-free (CWE-416) condition. The findings indicate authentication is not required and user interaction is not required, but exploitation is still described as requiring local access to the Windows Hyper-V environment. The CVSS is 7.4 (HIGH), with impacts including confidentiality, integrity, and availability. KEV status is not listed, there is no dated exploitation claim provided in the news findings, and no public exploit code is on record; however, Microsoft has released fixes, and this should be treated as a serious local privilege escalation risk for Hyper-V hosts.