CVE-2026-40402: Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2026-40402 is an elevation of privilege vulnerability in Windows Hyper-V, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.3 (Critical). An attacker can exploit it by an attacker with local access, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.33% probability of exploitation activity in the next 30 days, higher than 27% of all scored vulnerabilities. Microsoft released the fix on 12 May 2026 in the May 2026 Patch Tuesday, delivered through 4 security updates (KB5087545, KB5087424, KB5087420, KB5093998). It affects 4 products in 1 product family (Windows).
Key facts
- CVE ID
- CVE-2026-40402
- Severity
- Critical CVSS 9.3
- Microsoft severity
- Critical
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-416
- EPSS
- 0.33% (percentile 27%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2026 Patch Tuesday
- Product families
- Windows
From the May 2026 Patch Tuesday briefing
Windows Hyper‑V Elevation of Privilege
This vulnerability can allow an attacker to gain higher privileges in Hyper‑V environments, potentially crossing boundaries that should isolate workloads. A practical scenario is an attacker who already has code execution on a host or in a guest and uses this flaw to escalate privileges and expand control over virtualization resources, increasing blast radius. This CVSS 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) use-after-free (CWE-416) is a critical Hyper-V EoP with local attack vector but no privileges required, a combination that often maps to guest-to-host escape or cross-boundary compromise scenarios in virtualization stacks. The Scope: Changed (S:C) is the tell: exploitation can cross a security boundary, which in Hyper-V contexts frequently means a lower-privileged context (guest VM or constrained execution context) impacting the host or other tenants.
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-40402 at 9.3 (temporal 8.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
Frequently asked questions (Microsoft)
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
Under what circumstances might this vulnerability be exploited other than as a denial of service attack against a Hyper-V host?
This issue allows a guest VM to force the Hyper-V host's kernel to read from an arbitrary, potentially invalid address. The contents of the address read would not be returned to the guest VM. In most circumstances, this would result in a denial of service of the Hyper-V host (bugcheck) due to reading an unmapped address. It is possible to read from a memory mapped device register corresponding to a hardware device attached to the Hyper-V host which may trigger additional, hardware device specific side effects that could compromise the Hyper-V host's security.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
In this case, a successful attack could be performed from a low privilege Hyper-V guest. The attacker could traverse the guest's security boundary to gain access to the Hyper-V host environment.
Affected products (4)
Windows
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Windows Server 2022 | KB5087545 KB5087424 | Security Update Security Hotpatch Update | 10.0.20348.5139 10.0.20348.5074 | Yes Yes |
| Windows Server 2022 (Server Core installation) | KB5087545 KB5087424 | Security Update Security Hotpatch Update | 10.0.20348.5139 10.0.20348.5074 | Yes Yes |
| Windows 11 Version 23H2 for ARM64-based Systems | KB5087420 | Security Update | 10.0.22631.7079 | Yes |
| Windows 11 Version 23H2 for x64-based Systems | KB5093998 | Security Update | 10.0.22631.7219 | Yes |
Security updates (4)
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 9.3 (CRITICAL)
- NVD weakness
- CWE-416
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| windows 11 23h2 (arm64) | before 10.0.22631.7079 |
| windows 11 23h2 (x64) | before 10.0.22631.7079 |
| windows server 2022 | before 10.0.20348.5074 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40402 (Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |