An improper access control flaw in Windows Hyper‑V allows an attacker with local, authorized access to bypass a security feature that is intended to isolate virtual machine workloads. The vulnerability maps to an access control weakness (CWE‑284) and could enable the attacker to escape the confinement of a virtual machine or elevate privileges within the host environment, compromising both confidentiality and integrity of the system.

Microsoft Windows 10 releases 1607, 1809, 21H2, 22H2, Windows 11 releases 22H3, 23H2, 24H2, 25H2, 26H1, and all corresponding Windows Server releases 2016, 2019, 2022, 2025 (including Server Core installations). These versions are affected regardless of architecture as the advisory lists both x64 and ARM64 configurations.

The issue carries a CVSS score of 8.8, indicating high severity, but the EPSS score is reported as <1%, implying a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, reducing urgency for widespread immediate response. Because the defect requires local authorized access, remote exploitation is unlikely; an adversary must already have a foothold on the host to pursue this bypass. In that scenario, the attacker could potentially break out of the hypervisor’s isolation controls and gain elevated privileges on the host, leading to a full system compromise.