CVE-2026-80083: Windows 11 23H2 Hyper-V RCE Vulnerability

CVE-2026-80083 Overview

CVE-2026-80083 is an untrusted pointer dereference vulnerability [CWE-822] in Microsoft Windows Hyper-V. An authorized local attacker can leverage the flaw to execute code and cross the security boundary between a guest virtual machine and the host. The vulnerability affects multiple releases of Windows 11 and Windows Server, including Windows Server 2022 and Windows Server 2025. Microsoft published the advisory on September 8, 2026 through the Microsoft Security Update Guide.

Critical Impact
A low-privileged local user can trigger an untrusted pointer dereference in Hyper-V, resulting in code execution with a scope change that impacts confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1 (x64 and ARM64)
Microsoft Windows Server 2022
Microsoft Windows Server 2025

Discovery Timeline

2026-09-08 - CVE-2026-80083 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-80083

Vulnerability Analysis

CVE-2026-80083 is an untrusted pointer dereference in the Windows Hyper-V virtualization stack. Hyper-V processes data structures supplied by guest partitions when handling hypercalls, device emulation, and inter-partition communication. When Hyper-V accepts a pointer value without validating that it references trusted host memory, an attacker inside a guest can steer the hypervisor toward attacker-controlled memory. Dereferencing that pointer during a privileged operation lets the attacker execute code in a more privileged context.

The scope change reflected in the CVSS vector indicates the impact crosses the virtualization boundary. Successful exploitation therefore threatens tenant isolation, which is the primary security guarantee of a hypervisor. In multi-tenant or consolidated environments, a compromised guest can be used to attack the host operating system and neighboring virtual machines.

Root Cause

The root cause is improper validation of a pointer received from a lower-privileged context, categorized under [CWE-822: Untrusted Pointer Dereference]. Hyper-V trusts a pointer that originates from or is influenced by guest input and dereferences it during processing. Because the target address is attacker-controlled, memory reads or writes occur against unintended locations, producing memory corruption or direct control-flow hijacking inside the hypervisor or root partition.

Attack Vector

Exploitation requires local access with authenticated, low-privileged execution inside a Hyper-V guest. No user interaction is required. An attacker running code in a guest virtual machine issues crafted requests to the hypervisor interface, such as hypercalls or virtual device I/O, containing a malicious pointer value. When Hyper-V dereferences the pointer, the attacker gains code execution outside the guest boundary. Microsoft has not reported public exploitation, and no proof-of-concept is publicly available at the time of publication. Refer to the Microsoft Security Update Guide for CVE-2026-80083 for vendor technical detail.

Detection Methods for CVE-2026-80083

Indicators of Compromise

Unexpected crashes, bugchecks, or restarts of the vmms.exe (Virtual Machine Management Service) or vmwp.exe (Virtual Machine Worker Process) on Hyper-V hosts.
Hyper-V-Worker or Hyper-V-Hypervisor event log entries referencing invalid memory access, hypercall failures, or partition faults tied to a specific guest.
Guest virtual machines executing untrusted binaries immediately before host-side hypervisor faults.

Detection Strategies

Monitor Windows Event Logs under Microsoft-Windows-Hyper-V-Hypervisor and Microsoft-Windows-Hyper-V-Worker for anomalous error events correlated with guest activity.
Baseline hypercall and VMBus activity per guest and alert on volume spikes or malformed request patterns.
Correlate guest-side privilege escalation attempts with host-side process crashes to identify guest-to-host escape attempts.

Monitoring Recommendations

Forward Hyper-V operational and administrative event channels to a centralized logging platform for retention and correlation.
Track patch state across all Hyper-V hosts and flag systems missing the September 2026 security update.
Monitor for unauthorized guest creation, guest OS changes, or unexpected local logons on Hyper-V hosts by administrators outside change windows.

How to Mitigate CVE-2026-80083

Immediate Actions Required

Apply the September 2026 Microsoft security update for CVE-2026-80083 to all Hyper-V hosts running Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025.
Prioritize patching hosts that run untrusted, multi-tenant, or lower-trust guest workloads.
Restrict administrative and interactive access to Hyper-V guests to reduce the population of users able to attempt exploitation.

Patch Information

Microsoft has released security updates addressing CVE-2026-80083. Patch details, affected build numbers, and download links are documented in the Microsoft Security Update Guide for CVE-2026-80083. Administrators should deploy the update through Windows Update, Windows Server Update Services (WSUS), Microsoft Update Catalog, or their standard patch management tooling and reboot affected hosts to complete installation.

Workarounds

No official workaround has been published by Microsoft; patching is the recommended remediation.
Where patching must be delayed, consider migrating sensitive workloads off shared Hyper-V hosts and isolating untrusted guests on dedicated hardware.
Enforce least-privilege access for guest operating systems and Hyper-V administrators to limit which principals can execute code inside a guest.

bash

# Verify installed updates and Hyper-V role status on a Windows Server host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Get-WindowsFeature -Name Hyper-V
Get-VMHost | Select-Object Name, LogicalProcessorCount, VirtualMachineMigrationEnabled