CVE-2026-87705: Windows Hyper-V Auth Bypass Vulnerability

CVE-2026-87705 Overview

CVE-2026-87705 is a security feature bypass vulnerability in Windows Hyper-V. The flaw stems from improper verification of the source of a communication channel [CWE-940]. An unauthenticated attacker on an adjacent network can bypass a Hyper-V security feature without user interaction. Microsoft published the advisory through its Security Response Center. The vulnerability has a scope change (S:C), meaning successful exploitation affects resources beyond the vulnerable component. Confidentiality impact is high, while integrity and availability remain unaffected.

Critical Impact
An adjacent-network attacker can bypass Hyper-V security controls without authentication or user interaction, potentially exposing virtual machine data across trust boundaries.

Affected Products

Windows Hyper-V (specific build list published in the Microsoft Security Update Guide)
Windows Server releases shipping the Hyper-V role
Windows client editions with Hyper-V enabled

Discovery Timeline

2026-10-13 - CVE-2026-87705 published to the National Vulnerability Database
2026-10-13 - Last updated in the NVD database

Technical Details for CVE-2026-87705

Vulnerability Analysis

The vulnerability resides in how Windows Hyper-V verifies the source of inbound communication channels. Hyper-V relies on channel authenticity to enforce isolation between the host, management partition, and guest virtual machines. When the source check is incomplete, an attacker on the same logical network segment can present traffic that the hypervisor accepts as trusted. This bypass does not grant code execution or data modification, but it does defeat a security feature designed to constrain cross-partition access. The attacker requires no privileges and no user interaction. Because the vulnerability has a scope-changed impact, consequences extend beyond the Hyper-V component itself and reach protected resources.

Root Cause

The root cause is classified under [CWE-940]: Improper Verification of Source of a Communication Channel. Hyper-V accepts messages or session establishment without sufficiently validating the originator. This weakness allows spoofed or unauthorized endpoints to interact with a channel they should not reach.

Attack Vector

Exploitation requires adjacent-network access (AV:A), meaning the attacker must share a broadcast domain, VLAN, or virtual switch with the target. The attack complexity is low and no privileges are needed. No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS forecast remains low based on the Microsoft advisory snapshot.

No verified exploit code is published. See the Microsoft CVE-2026-87705 Update Guide for authoritative technical details.

Detection Methods for CVE-2026-87705

Indicators of Compromise

Unexpected Hyper-V channel establishment events originating from unmanaged hosts on the same VLAN or virtual switch
Anomalous VMBus or inter-partition traffic patterns not tied to legitimate management workflows
Hyper-V-Worker or Hyper-V-VMMS event log entries referencing unverified or rejected channel sources

Detection Strategies

Baseline normal Hyper-V management channel traffic and alert on deviations from authorized management hosts
Correlate Windows Event Log entries from the Hyper-V channels (Microsoft-Windows-Hyper-V-VMMS, Microsoft-Windows-Hyper-V-Worker) with network flow telemetry
Monitor adjacent-network reconnaissance activity against hypervisor hosts, including ARP sweeps and probing of Hyper-V management interfaces

Monitoring Recommendations

Forward Hyper-V operational and admin logs to a centralized SIEM for cross-host correlation
Enable network segmentation telemetry on virtual switches to identify unauthorized senders on management VLANs
Track patch deployment status across all Hyper-V hosts and flag systems missing the October 2026 security updates

How to Mitigate CVE-2026-87705

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-87705 Update Guide to all Hyper-V hosts
Inventory every system with the Hyper-V role enabled, including Windows client editions used for development
Restrict adjacent-network access to Hyper-V management interfaces using dedicated management VLANs

Patch Information

Microsoft published the fix through the Security Update Guide on 2026-10-13. Administrators should consult the vendor advisory for the specific KB article and build numbers that apply to each Windows SKU. Standard Windows Update, WSUS, and Microsoft Update Catalog distribution channels deliver the patch.

Workarounds

Place Hyper-V hosts on isolated management networks that exclude untrusted or user-accessible systems
Enforce 802.1X or MAC filtering on switch ports connected to hypervisor management interfaces
Disable the Hyper-V role on systems that do not require virtualization until patches are deployed

bash

# Example: list Hyper-V hosts missing the relevant KB using PowerShell
Get-HotFix -ComputerName (Get-Content hyperv-hosts.txt) |
  Where-Object { $_.HotFixID -eq 'KB-REPLACE-WITH-MSRC-KB' } |
  Select-Object PSComputerName, HotFixID, InstalledOn