CVE-2026-21255: Windows 10 1607 Auth Bypass Vulnerability

CVE-2026-21255 Overview

CVE-2026-21255 is an improper access control vulnerability [CWE-284] in Windows Hyper-V. An authorized local attacker can bypass a security feature on affected Windows and Windows Server systems. The flaw affects multiple Windows 10, Windows 11, and Windows Server releases that ship the Hyper-V role or platform components.

Microsoft published the advisory through the Microsoft Security Response Center (MSRC) and assigned the issue to the Hyper-V component. The scope change in the CVSS vector indicates that exploitation can cross a security boundary between the guest and host or between privilege contexts.

Critical Impact
A low-privileged local user on a vulnerable Hyper-V host can bypass a built-in security feature, leading to high confidentiality, integrity, and availability impact across the scoped boundary.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2 on x64 and ARM64)
Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-02-10 - CVE-2026-21255 published to NVD
2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-21255

Vulnerability Analysis

The vulnerability resides in Windows Hyper-V, Microsoft's Type-1 hypervisor that partitions hardware resources between a parent partition and child virtual machines. Improper access control [CWE-284] allows an authorized local actor to interact with a Hyper-V interface in a way the security model should prevent.

The CVSS vector specifies a scope change, meaning the vulnerable component and the impacted component are distinct. In Hyper-V, this pattern typically corresponds to a boundary between a guest virtual machine context and the host, or between a constrained user context and a privileged virtualization service.

Successful exploitation provides high impact to confidentiality, integrity, and availability. An attacker who bypasses the security feature can read protected data, alter virtualization state, or disrupt workloads running under Hyper-V protection.

Root Cause

The root cause is an access control flaw in how Hyper-V enforces a security feature for authorized callers. The component does not adequately validate the caller's authorization before permitting an action that should be restricted. Microsoft has not published implementation-level details in the public advisory.

Attack Vector

The attack vector is local. An attacker needs valid low-privilege credentials on a system running an affected Hyper-V build. No user interaction is required. Exploitation does not need network access, which limits exposure but raises risk in multi-tenant or shared-host environments where untrusted code runs alongside protected workloads.

No proof-of-concept code, exploit kit, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2026-21255 advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-21255

Indicators of Compromise

No public indicators of compromise have been associated with CVE-2026-21255 at this time.
Monitor for unexpected processes interacting with Hyper-V management interfaces such as vmms.exe, vmwp.exe, or vmcompute.exe from non-administrative user contexts.
Watch for unauthorized changes to virtual machine configuration files, snapshots, or VHD/VHDX storage paths.

Detection Strategies

Audit local logon events and correlate them with subsequent activity against Hyper-V WMI namespaces (root\virtualization\v2) and PowerShell Hyper-V module cmdlets.
Enable Windows Hyper-V-Worker and Hyper-V-Hypervisor operational and admin event channels and alert on abnormal API call sequences from standard user accounts.
Track creation of named pipes, COM objects, or device handles associated with the Hyper-V driver stack (vid.sys, winhvr.sys) by non-privileged processes.

Monitoring Recommendations

Forward Hyper-V event logs and Windows security logs to a centralized analytics platform for behavioral correlation across hosts.
Baseline normal Hyper-V administrative activity per host and alert on deviations, particularly from interactive low-privilege sessions.
Maintain inventory of Hyper-V-enabled hosts and verify patch compliance against the Microsoft February 2026 security update.

How to Mitigate CVE-2026-21255

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-21255 to all affected Windows and Windows Server systems running Hyper-V.
Prioritize patching on multi-tenant hosts, developer workstations running nested virtualization, and any host exposing Hyper-V to untrusted local users.
Audit local accounts on Hyper-V hosts and remove unnecessary interactive logon rights.

Patch Information

Microsoft released security updates for all affected versions through the standard Windows Update channel. Consult the Microsoft Security Update CVE-2026-21255 entry for the specific KB numbers that apply to each operating system build. Apply cumulative updates rather than standalone hotfixes to avoid regression.

Workarounds

Microsoft has not published a supported workaround. Patching is the recommended remediation path.
Where patching must be delayed, restrict interactive and remote local logon to Hyper-V hosts to trusted administrators only.
Disable the Hyper-V role on systems that do not require virtualization until updates can be applied.

bash

# Verify Hyper-V role status and installed updates on Windows Server
Get-WindowsFeature -Name Hyper-V
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Restrict interactive logon to administrators only via Group Policy:
# Computer Configuration > Windows Settings > Security Settings >
#   Local Policies > User Rights Assignment > "Allow log on locally"