CVE-2026-54127

Hyper-V is Windows’ built-in virtualization feature, used to run virtual machines on a server. This vulnerability is like a “stale memory” mistake inside Hyper-V that can let someone who already has local access gain higher privileges than they should. If an attacker can reach the Hyper-V environment locally, they may be able to take control of more of the system than intended.

This matters if you run Hyper-V on Windows 11, Windows Server 2022, or Windows Server 2025—especially if that Hyper-V environment is reachable by someone who could get local access (for example, an insider, compromised workstation, or someone with physical/remote access to the host). The vulnerability does not require a login or user interaction, but it still requires local access to the Hyper-V environment to be practical. If you don’t use Hyper-V on these systems (or you have strong controls preventing local access), your risk is lower.

Mark this as urgent because the flaw can elevate privileges locally without authentication or user interaction, which is the kind of condition attackers look for after they get a foothold. Even though CISA’s KEV list does not include this issue and there’s no clear dated public exploitation claim in the findings, the impact is high and Microsoft has released fixes—so you should patch based on exposure to Hyper-V rather than waiting.