CVE-2023-36427: Windows Hyper-V Privilege Escalation Flaw

CVE-2023-36427 Overview

CVE-2023-36427 is an elevation of privilege vulnerability affecting the Windows Hyper-V hypervisor across supported Windows 10, Windows 11, and Windows Server releases. Microsoft disclosed the issue as part of the November 2023 Patch Tuesday cycle. A successful attacker with low-privileged local access can escalate to higher privileges on the host, breaking the trust boundary between a Hyper-V guest and the host system.

The flaw carries an EPSS probability of 9.882% (93.087 percentile), indicating elevated exploitation likelihood relative to the broader CVE population, even though no public exploit is currently tracked.

Critical Impact
Successful exploitation grants high impact to confidentiality, integrity, and availability on the affected Hyper-V host, enabling guest-to-host privilege escalation in virtualized environments.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) x64
Microsoft Windows 11 (21H2, 22H2, 23H2) x64
Microsoft Windows Server 2019, 2022, and 2022 23H2

Discovery Timeline

2023-11-14 - Microsoft publishes security advisory for CVE-2023-36427
2023-11-14 - CVE-2023-36427 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36427

Vulnerability Analysis

The vulnerability resides in the Windows Hyper-V virtualization stack, which provides hardware-assisted isolation between guest virtual machines and the host operating system. An attacker authenticated on a guest VM with low privileges can trigger a defect in Hyper-V code paths to gain elevated privileges on the host or its hypervisor components.

Microsoft classifies the issue as an elevation of privilege rather than guest-to-host code execution, but the impact metrics indicate full compromise of confidentiality, integrity, and availability on the affected system. The vulnerability requires local access and high attack complexity, suggesting the attacker must win a race condition or satisfy specific runtime preconditions before exploitation succeeds.

Root Cause

Microsoft has not published a detailed root cause analysis. The CWE is recorded as NVD-CWE-noinfo. Based on the attack vector and impact, the defect likely involves improper validation or state handling within a Hyper-V kernel-mode component (vmswitch.sys, hvix64.exe, or related VMBus channel handling) reachable from a guest context.

Attack Vector

The attacker must already hold low-privileged execution inside a Hyper-V guest VM, or possess local access to a host running the Hyper-V role. Exploitation requires no user interaction. The high attack complexity rating indicates conditions outside the attacker's direct control, such as timing windows or specific memory layouts, must be met.

No public proof-of-concept code is available, no exploit is listed in Exploit-DB, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update for CVE-2023-36427 for vendor-supplied technical details.

Detection Methods for CVE-2023-36427

Indicators of Compromise

No file-based or network-based IOCs have been published by Microsoft for this vulnerability.
Unexpected privilege-escalation events on Hyper-V hosts, particularly those originating from accounts associated with guest VM workloads.
Anomalous loading or crashes of Hyper-V kernel components such as vmswitch.sys, vid.sys, or hvix64.exe.

Detection Strategies

Monitor Windows event logs for unexplained service or process privilege transitions on Hyper-V hosts and within guests.
Inspect Microsoft-Windows-Hyper-V-* operational and admin channels for hypercall errors, partition state anomalies, or VMBus channel resets.
Correlate guest VM kernel-mode activity with host-side bug check events (bugcheck / WER reports) tied to Hyper-V binaries.

Monitoring Recommendations

Baseline normal Hyper-V workload behavior and alert on deviations in hypercall volume, partition creation, or VMBus traffic.
Enable PowerShell and command-line auditing on Hyper-V hosts to capture management activity that could be abused post-escalation.
Forward host and guest security telemetry to a centralized analytics platform to enable cross-VM correlation of suspicious activity.

How to Mitigate CVE-2023-36427

Immediate Actions Required

Apply the November 2023 Microsoft security updates to all Hyper-V hosts and Windows Server systems running the Hyper-V role.
Inventory all systems matching the affected product list and prioritize patching of internet-exposed or multi-tenant hosts.
Restrict local logon and guest VM administrative access to trusted operators only until patches are deployed.

Patch Information

Microsoft released cumulative security updates addressing CVE-2023-36427 on November 14, 2023. Customers should consult the Microsoft Security Update Guide entry for CVE-2023-36427 to identify the specific KB article for each Windows build and apply it through Windows Update, WSUS, or the Microsoft Update Catalog.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation.
Where immediate patching is not feasible, reduce risk by limiting which users can create or run guest workloads on shared Hyper-V hosts.
Segment multi-tenant Hyper-V clusters so that untrusted workloads cannot share a host with sensitive partitions.

bash

# Verify the installed Windows build and confirm the November 2023 update is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Get-WindowsFeature -Name Hyper-V | Format-List Name,Installed,InstallState