Zero Radar
← feed
HighVulnerabilityCVE-2026-83839updated 27 Oct 2026, 19:56 UTC

Windows Hyper-V flaw lets local users gain higher privileges

A logged-in user on a Windows machine with Hyper-V could exploit a timing bug to get administrator-level control. Attackers usually need some existing access first.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesOfficial patch available via Microsoft Security Update Guide; specific fixed build numbers not stated in the provided material · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Local userHas a basic account on the machine
  2. 2Race conditionTiming gap in a Hyper-V check is exploited
  3. 3Privilege escalationAttacker gains higher system rights
  4. ResultAttacker gains elevated control of the host

What happened

A time-of-check time-of-use (TOCTOU) race condition in Windows Hyper-V allows an authorized local attacker to elevate privileges.

Why it is dangerous: An attacker with a basic local account could take full control of the Windows host, including its virtual machines. Shared or multi-user Windows servers with Hyper-V are most at risk.

Are you affected?

You are affected if you run Windows with the Hyper-V role enabled and untrusted or low-privilege users can log in locally.

Windows systems with Hyper-V (specific product versions not stated in the provided material)

What to do

  1. Install the Microsoft security update for CVE-2026-83839 through Windows Update or WSUS
  2. Restart the host after patching so the fix takes effect
  3. Limit local logon rights on systems running Hyper-V

Timeline

  1. 13 Oct 2026, 19:20 UTC
    Publicly disclosed
  2. 20 Oct 2026, 14:00 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  3. 27 Oct 2026, 19:56 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-83839
CVSS
7 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
13 Oct 2026, 19:20 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 19:56 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Windows Hyper-V flaw lets local users gain higher privileges · Zero Radar