CVE-2026-85343: Windows Hyper-V Privilege Escalation Flaw

CVE-2026-85343 Overview

CVE-2026-85343 is a link-following vulnerability [CWE-59] in Windows Hyper-V that allows an authorized local attacker to elevate privileges. The flaw stems from improper link resolution before file access, enabling a low-privileged user to redirect privileged file operations to attacker-controlled targets. Successful exploitation yields full confidentiality, integrity, and availability impact on the host.

Microsoft published the advisory on October 13, 2026. No public exploit code or in-the-wild exploitation has been reported at the time of writing.

Critical Impact
An authenticated local attacker can abuse symbolic or hard links handled by Hyper-V to elevate from a standard user to SYSTEM-level privileges on the affected host.

Affected Products

Microsoft Windows with Hyper-V role enabled
Windows Server editions supporting Hyper-V
Windows client editions supporting Hyper-V (Pro, Enterprise, Education)

Discovery Timeline

2026-10-13 - CVE-2026-85343 published to the National Vulnerability Database
2026-10-13 - Microsoft released the security update (Microsoft Security Update CVE-2026-85343)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85343

Vulnerability Analysis

The vulnerability resides in how Hyper-V resolves file paths before performing privileged file operations. When a privileged Hyper-V component accesses a file on behalf of a user, it does not sufficiently validate whether the path contains a symbolic link, junction, or hard link. An attacker who can create or control such links in writable locations can redirect the privileged write or open operation to a sensitive target file.

This class of flaw is categorized under [CWE-59]: Improper Link Resolution Before File Access ('Link Following'). It is a common root cause for local privilege escalation on Windows due to the widespread use of reparse points and object manager symbolic links.

Root Cause

The root cause is missing or insufficient link resolution checks in a Hyper-V code path that runs with elevated privileges. The privileged process trusts the final file target without verifying that path components have not been substituted via a symbolic link or junction created by a lower-privileged user.

Attack Vector

Exploitation requires local access and low privileges. The attacker must be able to execute code on the host and create reparse points or object directory links in a location accessed by Hyper-V. User interaction is not required. Successful exploitation elevates the attacker to SYSTEM.

See the Microsoft Security Update CVE-2026-85343 advisory for vendor technical details.

Detection Methods for CVE-2026-85343

Indicators of Compromise

Creation of symbolic links, junctions, or NTFS reparse points by low-privileged users in directories accessed by Hyper-V services (vmms.exe, vmcompute.exe, vmwp.exe)
Unexpected file writes to protected system paths performed by Hyper-V worker processes
Hyper-V service processes opening handles to paths outside their expected working directories

Detection Strategies

Monitor process behavior of vmms.exe, vmcompute.exe, and vmwp.exe for file access patterns that cross security boundaries
Audit Windows Event ID 4663 (object access) for Hyper-V service accounts touching files owned by standard users
Enable Sysmon File Create (Event ID 11) and FileCreateStreamHash events to flag suspicious reparse point creation

Monitoring Recommendations

Correlate token elevation events from Hyper-V processes with preceding link or junction creation by non-administrative users
Alert on new local administrator accounts or service modifications occurring shortly after Hyper-V activity on multi-tenant hosts
Track execution of utilities such as mklink, fsutil reparsepoint, and CreateSymbolicLink API usage from unprivileged contexts

How to Mitigate CVE-2026-85343

Immediate Actions Required

Apply the October 2026 Microsoft security update for all Windows systems with the Hyper-V role enabled
Inventory hosts running Hyper-V, including client editions used for development, and prioritize patching
Restrict interactive logon rights on Hyper-V hosts to administrators and trusted operators only

Patch Information

Microsoft released a security update addressing CVE-2026-85343 on October 13, 2026. Install the applicable cumulative update as detailed in the Microsoft Security Update CVE-2026-85343 guidance. There is no cryptographic hash or KB number listed in the NVD record; refer to the MSRC portal for the exact package per OS build.

Workarounds

Remove the Hyper-V role from hosts where it is not required until patches are applied
Deny the SeCreateSymbolicLinkPrivilege right to non-administrative users via Group Policy
Limit local logon on Hyper-V hosts and enforce least privilege for VM operators

bash

# Verify and restrict symbolic link creation privilege via Group Policy
# Local Security Policy > Local Policies > User Rights Assignment
# Setting: "Create symbolic links" (SeCreateSymbolicLinkPrivilege)
# Ensure only Administrators are listed.

# PowerShell: confirm Hyper-V role status
Get-WindowsFeature -Name Hyper-V

# PowerShell: check for installed update after patching
Get-HotFix | Sort-Object -Property InstalledOn -Descending