Loading story…
Microsoft disclosed CVE-2026-40401, an Important denial-of-service flaw in the Windows TCP/IP stack caused by a NULL pointer dereference and assigned it a CVSS 7.1 score. The company said exploitation requires no privileges or user interaction, has not been publicly disclosed or observed in the wild, and is considered less likely to be exploited. Microsoft has released a security update to address the issue.
The advisory warns that the bug can have broader impact in virtualized environments: a low-privilege Hyper-V guest could cross the guest boundary and trigger denial of service on the Hyper-V host. The disclosure aligns with Microsoft's continued patching of availability issues affecting virtualization components, including prior Windows Hyper-V denial-of-service flaws tracked as CVE-2025-47999 and CVE-2024-43633, as well as a Microsoft Virtual Hard Disk (VHDX) denial-of-service issue, CVE-2024-38264.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed CVE-2026-40401, an Important Windows TCP/IP denial-of-service vulnerability caused by a NULL pointer dereference, and made an official fix available. Microsoft said the flaw was not publicly disclosed or exploited in the wild at publication, and noted a scenario where a low-privilege Hyper-V guest could cause denial of service on the Hyper-V host.
Microsoft added a Security Update Guide entry for CVE-2025-47999, identified as a Windows Hyper-V denial-of-service vulnerability. No additional synopsis details are provided in the reference.
Microsoft published a Security Update Guide entry for CVE-2024-43633, a Windows Hyper-V denial-of-service vulnerability. The reference marks the vulnerability's disclosure on that date.
Microsoft published a Security Update Guide entry for CVE-2024-38264, a Microsoft Virtual Hard Disk (VHDX) denial-of-service vulnerability. The reference indicates public disclosure of the vulnerability on that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched three **Windows TCP/IP denial-of-service vulnerabilities** tracked as `CVE-2026-40405`, `CVE-2026-40413`, and `CVE-2026-40414`. The flaws stem from **NULL pointer dereference** conditions and can be triggered remotely without user interaction, causing high availability impact. Microsoft rated the issues **Important**, assigned CVSS scores of **7.5** for `CVE-2026-40405` and **7.4** for `CVE-2026-40413` and `CVE-2026-40414`, and said none of the vulnerabilities had been publicly disclosed or exploited in the wild at the time of publication. Microsoft said `CVE-2026-40413` and `CVE-2026-40414` are exploitable from an **adjacent network**, limiting attacks to the same network segment such as a shared switch or virtual network, while `CVE-2026-40405` is described as remotely exploitable over the network. The company warned that the adjacent-network flaws may involve a **scope change**, including scenarios in which a low-privilege **Hyper-V guest** could cross the guest boundary and deny service on the Hyper-V host. Microsoft has released official fixes for all three issues, adding to a broader pattern of Windows networking and TCP/IP denial-of-service advisories published in recent update cycles.
Jun 29, 2026
Microsoft disclosed and patched several **Windows Hyper-V elevation of privilege vulnerabilities** tracked as `CVE-2022-21901`, `CVE-2023-36427`, `CVE-2024-43624`, and `CVE-2025-54098`. The advisories identify a recurring security issue affecting Hyper-V components, including one flaw specifically tied to **Hyper-V Shared Virtual Disk**, with each entry published through Microsoft's Security Update Guide and related advisory portals. The vulnerabilities could allow attackers to gain higher privileges on affected Windows systems running Hyper-V, increasing the risk to virtualized environments and hosts that rely on Microsoft's hypervisor stack. Organizations using Hyper-V should review the relevant Microsoft advisories, determine exposure across guest and host infrastructure, and prioritize deployment of the corresponding security updates to reduce the chance of privilege escalation in enterprise virtualization deployments.
Jul 9, 2026
Microsoft has published security advisories for **CVE-2026-40402**, a **Windows Hyper-V Elevation of Privilege** vulnerability listed in the Microsoft Security Update Guide. The flaw affects Hyper-V, Microsoft's virtualization platform, and could allow an attacker to gain elevated privileges on a vulnerable system. The advisory was released through Microsoft's public update channels, including the Security Update Guide and MSRC advisory pages, but no public synopsis or technical details were provided in the referenced notices. Organizations using **Windows Hyper-V** should review Microsoft's guidance for affected versions, patch availability, and any mitigation steps tied to `CVE-2026-40402`.
Jul 9, 2026