Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-69910 2026-09-08

CVE-2026-69910: Critical Pre-Auth RCE in Windows Hyper-V

"Microsoft has disclosed a stack-based buffer overflow in Windows Hyper-V, tracked as CVE-2026-69910, that allows an unauthorized attacker to execute code over a network with a CVSS 3.1 base score of 9.8."

Microsoft has disclosed a stack-based buffer overflow in Windows Hyper-V, tracked as CVE-2026-69910, that allows an unauthorized attacker to execute code over a network with a CVSS 3.1 base score of 9.8.

What Is It

CVE-2026-69910 is a stack-based buffer overflow (CWE-121) in Windows Hyper-V. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." The CVE was published on 2026-09-08 by Microsoft ([email protected]) and currently carries an NVD status of "Awaiting Analysis."

Why It Matters

Microsoft assigned a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability dimension is at its worst setting: network attack vector, low attack complexity, no privileges required, and no user interaction; an exploitability subscore of 3.9. Impact is high across confidentiality, integrity, and availability (subscore 5.9). In short, a remote unauthenticated attacker reaching an affected Hyper-V host can achieve full compromise of it.

This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time.

What's Vulnerable

Microsoft lists a broad set of affected client and server builds, patched at the following build numbers:

Windows Server 2025 and Windows 11 24H2 are serviced from the same 10.0.26100 branch and therefore share a fixed build number. Affected platforms span 32-bit, x64-based, and ARM64-based systems depending on the product.

Patch Status

Fixed builds are identified for every affected product above. Administrators should consult the Microsoft Security Response Center update guide entry for CVE-2026-69910 and confirm hosts are at or above the listed build for their edition.

Microsoft's advisory does not list any workaround or mitigation for CVE-2026-69910, so installing the cumulative update that carries the fixed build is the only remediation. Where a host cannot be patched immediately, limit exposure by restricting network reachability of Hyper-V hosts, particularly management and live-migration interfaces, to trusted administrative networks, and treat any such host as a high-priority candidate for the next maintenance window. Virtualized workloads should be inventoried against the build list above, since a single unpatched host places every guest running on it at risk.

Sources