CVE-2026-57092: A CVSS 9.9 Flaw in Hyper-V VMSwitch Lets a Guest VM Own the Host
CVE-2026-57092 is a CVSS 9.9 use-after-free vulnerability in VMSwitch, the Windows component that handles networking between Hyper-V virtual machines, the management operating system, and physical or virtual network adapters. Microsoft patched it in July 2026, and if you run Hyper-V hosts, this is worth confirming you’ve actually applied, since the severity here is about as high as this category of bug gets, an authorized user inside a guest VM can escalate to full kernel-level code execution on the host hypervisor itself.
This one hasn’t been covered here before (we wrote about three other Hyper-V CVEs from the September 2026 Patch Tuesday round, this is a separate, distinct flaw from July). We don’t run Hyper-V in our lab (our domain controller doesn’t carry that role, and nesting it there wouldn’t be representative of a real deployment anyway), so the build-check methodology below is accurate and runnable in your own environment, not captured as lab output.
Why this one is especially severe
VMSwitch sits directly in the data path between every VM on a host and the network, which means it processes attacker-influenced input (network traffic) as a core part of its normal job. A use-after-free (CWE-416) in that component means a VM, including one you’ve deliberately isolated and consider low-trust, can potentially corrupt the hypervisor’s own memory and execute code at kernel privilege on the host. Microsoft’s own CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with a scope change, meaning the impact extends beyond the vulnerable component itself, exactly the profile of a guest-to-host hypervisor escape.
For anyone running multi-tenant Hyper-V (hosting provider environments, or even internal environments where different teams or trust levels share a host), this is the exact scenario the whole premise of VM isolation exists to prevent, and this flaw undermines it.
Who’s affected
Any Windows Server or Windows 11/10 Pro/Enterprise host running the Hyper-V role with an unpatched build. This isn’t limited to dedicated hosting infrastructure, any workstation or server using Hyper-V, including for local development VMs or WSL2 (which uses a lightweight Hyper-V-based VM under the hood on modern Windows), is in scope if the underlying platform build is unpatched.
Step 1: check your installed build against the July 2026 fix
# Check current build and most recent updates
Get-ComputerInfo | Select-Object OsName, OsVersion, WindowsBuildLabEx
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, Description, InstalledOnCompare your most recent installed update’s date against Microsoft’s July 2026 Patch Tuesday release for your specific OS version, if your newest update predates that release, you’re exposed. As with any CVE, don’t rely solely on a raw build number comparison, cross-reference against the specific KB that shipped the fix for your OS version in Microsoft’s own advisory.
Step 2: apply the current cumulative update
There’s no standalone patch for this specific CVE in isolation, it ships as part of the regular monthly cumulative update. If you’re behind, schedule the current cumulative update through your normal patch management process, a reboot is required since this touches a kernel-level driver.
Step 3: if you can’t patch immediately, reduce guest-to-guest exposure
Since this requires a VM an attacker already has some level of access to, review which VMs on a given host represent genuinely untrusted or lower-trust workloads, and whether they need to share a host with higher-value VMs at all while unpatched. This isn’t a substitute for patching, VMSwitch mediates traffic for every VM on the host regardless of how you’ve segmented them logically, but reducing the blast radius of co-located workloads is a reasonable interim step while you schedule the actual update.
Quick guide
- Check every Hyper-V host’s current build and most recent installed updates.
- Compare against Microsoft’s July 2026 cumulative update for your specific OS version, not a generic build number.
- Schedule the update and a reboot if you’re behind.
- While waiting on a patch window, review which lower-trust VMs share a host with higher-value workloads.
FAQ
Does this affect VMware, Proxmox, or other non-Hyper-V hypervisors?
No, this specific CVE is in Windows’s own VMSwitch component, specific to the Hyper-V platform. It doesn’t affect VMware ESXi, Proxmox VE, or other hypervisor platforms, which have their own separate codebases and their own separate vulnerability histories.
Does running WSL2 put me at risk even if I don’t use Hyper-V directly?
WSL2 runs on a lightweight Hyper-V-based virtual machine platform under the hood, even if you’ve never explicitly enabled the Hyper-V role or created a VM yourself. If your Windows build is unpatched, that underlying platform is still unpatched, keep your OS current through normal Windows Update regardless of whether you think of yourself as “using Hyper-V.”
Has this been exploited in the wild?
Public reporting as of this writing doesn’t confirm active exploitation or publish the specific technical exploitation chain, which is appropriate restraint given the severity. Treat the lack of a confirmed public exploit as “patch before one appears,” not as a reason to deprioritize this, CVSS 9.9 virtualization-boundary flaws are exactly the kind of bug that attracts serious attacker interest once patched builds make the vulnerable code path easier to diff against.
Is this related to the Hyper-V CVEs covered here from September 2026?
No, those were three separate, distinct vulnerabilities disclosed in the September 2026 Patch Tuesday cycle. This one was disclosed in July 2026. If you’re running Hyper-V, both sets are worth checking independently, being patched against one doesn’t imply coverage of the other.
