{"id":"CVE-2026-105733","published":"2026-10-13T19:18:01.443","lastModified":"2026-10-16T16:16:56.900","description":"Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105733","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Windows Hyper-V suffers from improper access control that allows authorized users to execute arbitrary code locally on the host system. This represents a significant privilege escalation vulnerability where a local attacker can potentially break out of virtual machine isolation and compromise the entire host.","exploitability":"Exploitation requires a local authenticated user with access to Hyper-V services, which is moderately difficult but achievable in environments where users have legitimate administrative access or are running virtual machines.","blast_radius":"If exploited, this vulnerability could allow attackers to execute code on the Hyper-V host system, potentially leading to complete compromise of all virtual machines hosted on that system and enabling lateral movement throughout the network.","remediation":"Apply the latest Windows updates including KB5042819 or later, which contain the necessary fixes for this Hyper-V access control flaw.","detection":"Monitor for unusual Hyper-V service access patterns in Windows Event Logs, particularly Event ID 4200 and 4201 related to virtual machine configuration changes, and look for unexpected process creation from Hyper-V management services.","tags":["privilege-escalation","hypervisor","local-exploitation"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:54:48.730Z"}}