CVE-2026-87705 is an improper verification of source of a communication channel vulnerability in Windows Hyper‑V. An attacker that can influence or observe a communication path adjacent to a virtual machine can manipulate the channel used by Hyper‑V to communicate with the host and can bypass a built‑in security check. The primary impact is that the validation failure can allow unauthorized manipulation or bypass of a security feature, potentially enabling privilege escalation or unauthorized access to host resources. This weakness is identified as CWE‑940, which involves improper verification of source of a communication channel.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, plus their Server Core installations. The vulnerability is present across x86, x64, and arm64 architectures as indicated by the affected CPE strings. All listed Windows operating systems running Hyper‑V services are potentially affected.

The CVSS score of 7.4 places it in the High severity range. The EPSS score is not available, so the actual likelihood of exploitation in the wild remains uncertain. As it is not listed in the CISA KEV catalog, there is no confirmed exploitation in the field. However, given that the flaw allows a bypass of a security check that Hyper‑V performs on adjacent network traffic, the likely attack vector would involve an attacker on the same physical network or adjacent virtual switch fabric able to control or read the channel. If an attacker can reach the channel, the vulnerability could be leveraged with little additional effort and no privilege on the host to gain elevated privileges or to change host configuration. Because the flaw involves source verification, an attacker may need to establish a crafted communication channel to trigger the bypass.