Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass the Virtualization-based Security feature.
How could an attacker exploit this vulnerability?
Exploitation requires an attacker who already has local execution on a VBS‑enabled guest VM to run a specially crafted application or driver that abuses the hypervisor’s overlay handling to bypass VBS/VTL protections and compromise kernel integrity.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Security updates
10.0.28000.1575 — https://support.microsoft.com/help/5077179
10.0.17763.8389 — https://support.microsoft.com/help/5075904
10.0.20348.4773 — https://support.microsoft.com/help/5075906
10.0.20348.4711 — https://support.microsoft.com/help/5075943
10.0.19044.6937 — https://support.microsoft.com/help/5075912
10.0.26100.32370 — https://support.microsoft.com/help/5075899
10.0.26100.32313 — https://support.microsoft.com/help/5075942
10.0.26200.7840 — https://support.microsoft.com/help/5077181
10.0.26200.7781 — https://support.microsoft.com/help/5077212
10.0.22631.6649 — https://support.microsoft.com/help/5075941
10.0.25398.2149 — https://support.microsoft.com/help/5075897
10.0.14393.8868 — https://support.microsoft.com/help/5075999
Vulnerabilities 1
-
High 8.8
Windows Hyper-V Security Feature Bypass Vulnerability
Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.
Revision history
-
#1
Information published.
-
#2
The FAQs have been updated for this CVE
References
-
CVE-2026-21255 Windows Hyper-V Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21255
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss