Loading story…
Microsoft disclosed and patched several Windows Hyper-V elevation of privilege vulnerabilities tracked as CVE-2022-21901, CVE-2023-36427, CVE-2024-43624, and CVE-2025-54098. The advisories identify a recurring security issue affecting Hyper-V components, including one flaw specifically tied to Hyper-V Shared Virtual Disk, with each entry published through Microsoft's Security Update Guide and related advisory portals.
The vulnerabilities could allow attackers to gain higher privileges on affected Windows systems running Hyper-V, increasing the risk to virtualized environments and hosts that rely on Microsoft's hypervisor stack. Organizations using Hyper-V should review the relevant Microsoft advisories, determine exposure across guest and host infrastructure, and prioritize deployment of the corresponding security updates to reduce the chance of privilege escalation in enterprise virtualization deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft published CVE-2025-54098 in its Security Update Guide as a Windows Hyper-V Elevation of Privilege vulnerability.
Microsoft released Security Update Guide details for CVE-2024-43624, identified as a Windows Hyper-V Shared Virtual Disk Elevation of Privilege vulnerability.
Microsoft published Security Update Guide information for CVE-2023-36427, describing it as a Windows Hyper-V Elevation of Privilege vulnerability.
Microsoft added CVE-2022-21901 to its Security Update Guide as a Windows Hyper-V Elevation of Privilege vulnerability.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has published security advisories for **CVE-2026-40402**, a **Windows Hyper-V Elevation of Privilege** vulnerability listed in the Microsoft Security Update Guide. The flaw affects Hyper-V, Microsoft's virtualization platform, and could allow an attacker to gain elevated privileges on a vulnerable system. The advisory was released through Microsoft's public update channels, including the Security Update Guide and MSRC advisory pages, but no public synopsis or technical details were provided in the referenced notices. Organizations using **Windows Hyper-V** should review Microsoft's guidance for affected versions, patch availability, and any mitigation steps tied to `CVE-2026-40402`.
Jul 9, 2026
Microsoft published Security Update Guide entries for several CVEs affecting its products, including **Windows Hyper-V Information Disclosure Vulnerability** `CVE-2023-36406` and additional advisories for `CVE-2024-26188`, `CVE-2025-21271`, `CVE-2025-21274`, `CVE-2025-21302`, `CVE-2026-24285`, and `CVE-2026-25177`. The references indicate a continuing stream of vulnerability disclosures across Microsoft’s ecosystem, with Hyper-V specifically identified in one advisory as an information disclosure issue. The available records provide limited technical detail, but they show Microsoft tracking and publishing these flaws through the MSRC Security Update Guide and portal advisories. For defenders, the immediate takeaway is to review the listed CVEs in Microsoft’s update channels, determine product exposure across Windows and virtualization environments, and prioritize remediation or compensating controls where affected systems are present.
Jul 9, 2026
Microsoft disclosed and patched three **Windows TCP/IP denial-of-service vulnerabilities** tracked as `CVE-2026-40405`, `CVE-2026-40413`, and `CVE-2026-40414`. The flaws stem from **NULL pointer dereference** conditions and can be triggered remotely without user interaction, causing high availability impact. Microsoft rated the issues **Important**, assigned CVSS scores of **7.5** for `CVE-2026-40405` and **7.4** for `CVE-2026-40413` and `CVE-2026-40414`, and said none of the vulnerabilities had been publicly disclosed or exploited in the wild at the time of publication. Microsoft said `CVE-2026-40413` and `CVE-2026-40414` are exploitable from an **adjacent network**, limiting attacks to the same network segment such as a shared switch or virtual network, while `CVE-2026-40405` is described as remotely exploitable over the network. The company warned that the adjacent-network flaws may involve a **scope change**, including scenarios in which a low-privilege **Hyper-V guest** could cross the guest boundary and deny service on the Hyper-V host. Microsoft has released official fixes for all three issues, adding to a broader pattern of Windows networking and TCP/IP denial-of-service advisories published in recent update cycles.
Jun 29, 2026